From 0cef8952475981ef339062f7a3b3ebd636f7e15d Mon Sep 17 00:00:00 2001 From: Eric Jenkins Date: Mon, 18 Nov 2019 09:30:51 -0500 Subject: [PATCH 01/42] Updated based on issue (#523) --- CHANGELOG.md | 2 ++ Module/STIG/STIG.psm1 | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f372f406f..5a03aceaa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,8 @@ ## Unreleased +* Fixed [#521](https://github.com/microsoft/PowerStig/issues/521): Organizational setting warning should include Stig name + ## 4.1.1 * Fixed [#517](https://github.com/microsoft/PowerStig/issues/517): 4.1.0 GPRegistryPolicyDsc Module Version Issue diff --git a/Module/STIG/STIG.psm1 b/Module/STIG/STIG.psm1 index 2e111c5ec..e070c21ad 100644 --- a/Module/STIG/STIG.psm1 +++ b/Module/STIG/STIG.psm1 @@ -254,7 +254,7 @@ Class STIG } else { - Write-Warning -Message "RuleId: $($rule.Id) contains an empty Organizational Value, setting rule as Skipped" + Write-Warning -Message "RuleId: $($rule.Id) in $($rule.ParentNode.ParentNode.stigid) contains an empty Organizational Value, setting rule as Skipped" $importRule = [SkippedRule]::new($rule) } } From 0ed4e53ba4cffa0a5059c09959a45f730755cfed Mon Sep 17 00:00:00 2001 From: Eric Jenkins Date: Mon, 18 Nov 2019 12:27:44 -0500 Subject: [PATCH 02/42] Feature request: additional support for servicerule properties #514 (#525) * Added property based on community request * updated issue version --- CHANGELOG.md | 1 + DSCResources/Resources/windows.Service.ps1 | 1 + 2 files changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5a03aceaa..1659ff4ee 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## Unreleased +* Fixed [#514](https://github.com/microsoft/PowerStig/issues/514): Feature request: additional support for servicerule properties * Fixed [#521](https://github.com/microsoft/PowerStig/issues/521): Organizational setting warning should include Stig name ## 4.1.1 diff --git a/DSCResources/Resources/windows.Service.ps1 b/DSCResources/Resources/windows.Service.ps1 index 13b79d154..aee164be0 100644 --- a/DSCResources/Resources/windows.Service.ps1 +++ b/DSCResources/Resources/windows.Service.ps1 @@ -10,5 +10,6 @@ foreach ( $rule in $rules ) Name = $rule.ServiceName State = $rule.ServiceState StartupType = $rule.StartupType + Ensure = $rule.Ensure } } From 2feedd238d4f5fa1a7be323c4a79e44179e429f5 Mon Sep 17 00:00:00 2001 From: Eric Jenkins Date: Mon, 18 Nov 2019 17:41:17 -0500 Subject: [PATCH 03/42] Updated win10 system drive path in convert module (#526) --- CHANGELOG.md | 1 + Module/Rule.Permission/Convert/Methods.ps1 | 2 +- StigData/Processed/WindowsClient-10-1.17.xml | 4 ++-- StigData/Processed/WindowsClient-10-1.18.xml | 4 ++-- 4 files changed, 6 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1659ff4ee..083378b55 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## Unreleased +* Fixed [#427](https://github.com/microsoft/PowerStig/issues/427): Windows 10 Rule V-63373 fails to apply settings to system drive * Fixed [#514](https://github.com/microsoft/PowerStig/issues/514): Feature request: additional support for servicerule properties * Fixed [#521](https://github.com/microsoft/PowerStig/issues/521): Organizational setting warning should include Stig name diff --git a/Module/Rule.Permission/Convert/Methods.ps1 b/Module/Rule.Permission/Convert/Methods.ps1 index 3c48a7a57..9f4439c9d 100644 --- a/Module/Rule.Permission/Convert/Methods.ps1 +++ b/Module/Rule.Permission/Convert/Methods.ps1 @@ -172,7 +172,7 @@ function Get-PermissionTargetPath $stigString -notmatch $regularExpression.programFileFolder } { - $permissionTargetPath = '%SystemDrive%' + $permissionTargetPath = '%SystemDrive%\' break } { $stigString -match $regularExpression.winDir } diff --git a/StigData/Processed/WindowsClient-10-1.17.xml b/StigData/Processed/WindowsClient-10-1.17.xml index 533acc5d6..7a1d7f17a 100644 --- a/StigData/Processed/WindowsClient-10-1.17.xml +++ b/StigData/Processed/WindowsClient-10-1.17.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the amount of time that an account will remain locked after the specified number of failed logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -1748,7 +1748,7 @@ If accounts with administrative privileges are not prevented from using applicat False False - %SystemDrive% + %SystemDrive%\ The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160). If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding. Verify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) diff --git a/StigData/Processed/WindowsClient-10-1.18.xml b/StigData/Processed/WindowsClient-10-1.18.xml index 8cdc7da7a..29914f71a 100644 --- a/StigData/Processed/WindowsClient-10-1.18.xml +++ b/StigData/Processed/WindowsClient-10-1.18.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the amount of time that an account will remain locked after the specified number of failed logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -1753,7 +1753,7 @@ If accounts with administrative privileges are not prevented from using applicat False False - %SystemDrive% + %SystemDrive%\ The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160). If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding. Verify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) From b72167ca3069914aaa1c8711f2d26d02e70195af Mon Sep 17 00:00:00 2001 From: Steve Hose Date: Tue, 19 Nov 2019 09:53:06 -0500 Subject: [PATCH 04/42] Updates for Issues #259 and #527 --- Module/STIG/Functions.Checklist.ps1 | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/Module/STIG/Functions.Checklist.ps1 b/Module/STIG/Functions.Checklist.ps1 index 643bad847..370e4462a 100644 --- a/Module/STIG/Functions.Checklist.ps1 +++ b/Module/STIG/Functions.Checklist.ps1 @@ -87,7 +87,6 @@ function New-StigCheckList 'HOST_NAME' = '' 'HOST_IP' = '' 'HOST_MAC' = '' - 'HOST_GUID' = '' 'HOST_FQDN' = '' 'TECH_AREA' = '' 'TARGET_KEY' = '2350' @@ -209,6 +208,7 @@ function New-StigCheckList elseif ($PSCmdlet.ParameterSetName -eq 'result') { $setting = Get-SettingsFromResult -DscResult $dscResult -Id $vid + $manualCheck = $manualCheckData | Where-Object {$_.VulID -eq $VID} if ($setting) { @@ -216,6 +216,11 @@ function New-StigCheckList { $status = $statusMap['NotAFinding'] } + elseif ($manualCheck) + { + $status = $statusMap["$($manualCheck.Status)"] + $comments = $manualCheck.Comments + } else { $status = $statusMap['Open'] From 2abeef5578795c7e6dabee9a26cf4476445f0c74 Mon Sep 17 00:00:00 2001 From: Brian Wilhite Date: Wed, 20 Nov 2019 10:28:21 -0500 Subject: [PATCH 05/42] added support for 2012R2 MS/DC 2.17/2.18 (#532) * added support for 2012R2 MS/DC 2.17/2.18 * added new line on the xccdf * removed tab from processed xml. --- CHANGELOG.md | 1 + ...nd_2012_R2_DC_STIG_V2R18_Manual-xccdf.log} | 2 +- ...nd_2012_R2_DC_STIG_V2R18_Manual-xccdf.xml} | 53 +- ...nd_2012_R2_MS_STIG_V2R17_Manual-xccdf.log} | 2 +- ...nd_2012_R2_MS_STIG_V2R17_Manual-xccdf.xml} | 446 +- ..._Windows_2012_and_2012_R2_DC_STIG-xccdf.md | 40 - ..._Windows_2012_and_2012_R2_MS_STIG-xccdf.md | 23 - ...dowsServer-2012R2-DC-2.18.org.default.xml} | 2 +- ...6.xml => WindowsServer-2012R2-DC-2.18.xml} | 97 +- ...dowsServer-2012R2-MS-2.17.org.default.xml} | 142 +- ...5.xml => WindowsServer-2012R2-MS-2.17.xml} | 9635 ++++++++--------- 11 files changed, 5169 insertions(+), 5274 deletions(-) rename StigData/Archive/Windows.Server.2012R2/{U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R16_Manual-xccdf.log => U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.log} (97%) rename StigData/Archive/Windows.Server.2012R2/{U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R16_Manual-xccdf.xml => U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.xml} (86%) rename StigData/Archive/Windows.Server.2012R2/{U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R15_Manual-xccdf.log => U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R17_Manual-xccdf.log} (97%) rename StigData/Archive/Windows.Server.2012R2/{U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R15_Manual-xccdf.xml => U_MS_Windows_2012_and_2012_R2_MS_STIG_V2R17_Manual-xccdf.xml} (85%) delete mode 100644 StigData/Archive/Windows.Server.2012R2/U_Windows_2012_and_2012_R2_DC_STIG-xccdf.md delete mode 100644 StigData/Archive/Windows.Server.2012R2/U_Windows_2012_and_2012_R2_MS_STIG-xccdf.md rename StigData/Processed/{WindowsServer-2012R2-DC-2.16.org.default.xml => WindowsServer-2012R2-DC-2.18.org.default.xml} (99%) rename StigData/Processed/{WindowsServer-2012R2-DC-2.16.xml => WindowsServer-2012R2-DC-2.18.xml} (99%) rename StigData/Processed/{WindowsServer-2012R2-MS-2.15.org.default.xml => WindowsServer-2012R2-MS-2.17.org.default.xml} (97%) rename StigData/Processed/{WindowsServer-2012R2-MS-2.15.xml => WindowsServer-2012R2-MS-2.17.xml} (98%) diff --git a/CHANGELOG.md b/CHANGELOG.md index 083378b55..4c1864084 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ * Fixed [#427](https://github.com/microsoft/PowerStig/issues/427): Windows 10 Rule V-63373 fails to apply settings to system drive * Fixed [#514](https://github.com/microsoft/PowerStig/issues/514): Feature request: additional support for servicerule properties * Fixed [#521](https://github.com/microsoft/PowerStig/issues/521): Organizational setting warning should include Stig name +* Update PowerSTIG to parse/convert the Windows Server 2012 R2 MS/DC V2R17/V2R18 Respectively: [531](https://github.com/microsoft/PowerStig/issues/531) ## 4.1.1 diff --git a/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R16_Manual-xccdf.log b/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.log similarity index 97% rename from StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R16_Manual-xccdf.log rename to StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.log index 95062765f..e3818035c 100644 --- a/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R16_Manual-xccdf.log +++ b/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.log @@ -6,7 +6,7 @@ V-2379::is greater than 7 days::is greater than "7" days V-2380::is greater than 5 minutes::is greater than "5" minutes V-6836::"Minimum password length,"::"Minimum password length" V-8316::*::'' -V-36707::Value: 0x00000001 (1) ::Value: 1 Or 2 +V-36707::Value: 0x00000001 (1) ::Value: 1 Or 2 V-36736::*::HardCodedRule(ServiceRule)@{DscResource = 'Service'; Ensure = 'Present'; ServiceName = $null; ServiceState = 'Running'; StartupType = $null; OrganizationValueTestString = 'ServiceName/StartupType is populated with correct Certificate Revocation Checking service information'} V-42420::*::HardCodedRule(ServiceRule)@{DscResource = 'Service'; Ensure = 'Present'; ServiceName = $null; ServiceState = 'Running'; StartupType = $null; OrganizationValueTestString = 'ServiceName/StartupType is populated with correct Firewall service information'} V-80473::*::HardCodedRule(AuditSettingRule)@{DscResource = 'AuditSetting'; DesiredValue = '6.3.9600.17415'; Operator = '-ge'; Property = 'Version'; Query = "SELECT * FROM CIM_Datafile WHERE FileName='powershell' AND Path LIKE '%\\Windows\\System32\\WindowsPowerShell\\v1.0\\%' AND Extension='exe'"} diff --git a/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R16_Manual-xccdf.xml b/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.xml similarity index 86% rename from StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R16_Manual-xccdf.xml rename to StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.xml index 07531e3b0..78f53a48e 100644 --- a/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R16_Manual-xccdf.xml +++ b/StigData/Archive/Windows.Server.2012R2/U_MS_Windows_2012_and_2012_R2_DC_STIG_V2R18_Manual-xccdf.xml @@ -1,4 +1,4 @@ -acceptedWindows Server 2012/2012 R2 Domain Controller Security Technical Implementation GuideThe Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.Developed_by_DISA_for_the_DoDDISASTIG.DOD.MILRelease: 16 Benchmark Date: 26 Apr 20192I - Mission Critical Classified<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>Physical security<GroupDescription></GroupDescription>WN12-00-000001Server systems must be located in a controlled access area, accessible only to authorized personnel.<VulnDiscussion>Inadequate physical protection can undermine all other security precautions utilized to protect the system. This can jeopardize the confidentiality, availability, and integrity of the system. Physical security is the first line of protection of any system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Ensure servers are located in secure, access-controlled areas.Verify servers are located in controlled access areas that are accessible only to authorized personnel. If systems are not adequately protected, this is a finding.Shared User Accounts<GroupDescription></GroupDescription>WN12-00-000012Shared user accounts must not be permitted on the system.<VulnDiscussion>Shared accounts (accounts where two or more people log in with the same user identification) do not provide adequate identification and authentication. There is no way to provide for nonrepudiation or individual accountability for system access and resource usage.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000764Remove unapproved shared accounts from the system. +acceptedWindows Server 2012/2012 R2 Member Server Security Technical Implementation GuideThe Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.Developed_by_DISA_for_the_DoDDISASTIG.DOD.MILRelease: 17 Benchmark Date: 25 Oct 20192I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>Physical security<GroupDescription></GroupDescription>WN12-00-000001Server systems must be located in a controlled access area, accessible only to authorized personnel.<VulnDiscussion>Inadequate physical protection can undermine all other security precautions utilized to protect the system. This can jeopardize the confidentiality, availability, and integrity of the system. Physical security is the first line of protection of any system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Ensure servers are located in secure, access-controlled areas.Verify servers are located in controlled access areas that are accessible only to authorized personnel. If systems are not adequately protected, this is a finding.Shared User Accounts<GroupDescription></GroupDescription>WN12-00-000012Shared user accounts must not be permitted on the system.<VulnDiscussion>Shared accounts (accounts where two or more people log in with the same user identification) do not provide adequate identification and authentication. There is no way to provide for nonrepudiation or individual accountability for system access and resource usage.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000764Remove unapproved shared accounts from the system. Document required shared accounts with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity.Determine whether any shared accounts exist. If no shared accounts exist, this is NA. Shared accounts, such as required by an application, may be approved by the organization. This must be documented with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity. -If unapproved shared accounts exist, this is a finding.Unsupported Service Packs<GroupDescription></GroupDescription>WN12-GE-000001Systems must be maintained at a supported service pack level.<VulnDiscussion>Systems at unsupported service packs or releases will not receive security updates for new vulnerabilities, which leave them subject to exploitation. Systems must be maintained at a service pack level supported by the vendor with new security updates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Update the system to a supported release or service pack level.Run "winver.exe". +If unapproved shared accounts exist, this is a finding.Unsupported Service Packs<GroupDescription></GroupDescription>WN12-GE-000001Systems must be maintained at a supported service pack level.<VulnDiscussion>Systems at unsupported service packs or releases will not receive security updates for new vulnerabilities, which leave them subject to exploitation. Systems must be maintained at a service pack level supported by the vendor with new security updates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Update the system to a supported release or service pack level.Run "winver.exe". -If the "About Windows" dialog box does not display -"Microsoft Windows Server +If the "About Windows" dialog box does not display +"Microsoft Windows Server Version 6.2 (Build 9200)" -or greater, this is a finding. - -No preview versions will be used in a production environment. +or greater, this is a finding. + +No preview versions will be used in a production environment. Unsupported Service Packs/Releases: Windows 2012 - any release candidates or versions prior to the initial release.WIN00-000100<GroupDescription></GroupDescription>WN12-00-000100The Windows 2012 / 2012 R2 system must use an anti-virus program.<VulnDiscussion>Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Install an anti-virus solution on the system.Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution. If there is no anti-virus solution installed on the system, this is a finding.Display Shutdown Button<GroupDescription></GroupDescription>WN12-SO-000073The shutdown option must not be available from the logon dialog box.<VulnDiscussion>Displaying the shutdown button may allow individuals to shut down a system anonymously. Only authenticated users should be allowed to shut down the system. Preventing display of this button in the logon dialog box ensures that individuals who shut down the system are authorized and tracked in the system's Security event log.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25100-9CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Shutdown: Allow system to be shutdown without having to log on" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: ShutdownWithoutLogon Value Type: REG_DWORD -Value: 0System Recovery Backups<GroupDescription></GroupDescription>WN12-00-000014System-level information must be backed up in accordance with local recovery time and recovery point objectives.<VulnDiscussion>Operating system backup is a critical step in maintaining data assurance and availability. +Value: 0System Recovery Backups<GroupDescription></GroupDescription>WN12-00-000014System-level information must be backed up in accordance with local recovery time and recovery point objectives.<VulnDiscussion>Operating system backup is a critical step in maintaining data assurance and availability. -System-level information includes system-state information, operating system and application software, and licenses. +System-level information includes system-state information, operating system and application software, and licenses. Backups must be consistent with organizational recovery time and recovery point objectives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Implement system-level information backups in accordance with local recovery time and recovery point objectives.Determine whether system-level information is backed up in accordance with local recovery time and recovery point objectives. If system-level information is not backed up in accordance with local recovery time and recovery point objectives, this is a finding.NTFS Requirement<GroupDescription></GroupDescription>WN12-GE-000005Local volumes must use a format that supports NTFS attributes.<VulnDiscussion>The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system. To support this, local volumes must be formatted using a file system that supports NTFS attributes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000213Format local volumes to use NTFS or ReFS.Open "Computer Management". @@ -52,7 +52,7 @@ By using this IS (which includes any device attached to this IS), you consent to -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: LegalNoticeText @@ -86,7 +86,7 @@ Value Name: CachedLogonsCount Value Type: REG_SZ Value: 4 (or less)Anonymous shares are not restricted<GroupDescription></GroupDescription>WN12-SO-000052Anonymous enumeration of shares must be restricted.<VulnDiscussion>Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24774-2CCI-001090Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Do not allow anonymous enumeration of SAM accounts and shares" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymous @@ -154,7 +154,7 @@ Copy or enter the lines below to the PowerShell window and enter. (Entering twic if ($lastLogin -eq $null) { $lastLogin = 'Never' } - Write-Host $user.Name $lastLogin $enabled + Write-Host $user.Name $lastLogin $enabled }" This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False). @@ -190,13 +190,13 @@ Run "gpedit.msc". Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. -If the value for "Accounts: Rename administrator account" is not set to a value other than "Administrator", this is a finding.Booting into Multiple Operating Systems<GroupDescription></GroupDescription>WN12-GE-000010The system must not boot into multiple operating systems (dual-boot).<VulnDiscussion>Allowing a system to boot into multiple operating systems (dual-booting) may allow security to be circumvented on a secure system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Ensure Windows Server 2012 is the only operating system installed for the system to boot into. Remove alternate operating systems.Verify the local system boots directly into Windows. +If the value for "Accounts: Rename administrator account" is not set to a value other than "Administrator", this is a finding.Booting into Multiple Operating Systems<GroupDescription></GroupDescription>WN12-GE-000010The system must not boot into multiple operating systems (dual-boot).<VulnDiscussion>Allowing a system to boot into multiple operating systems (dual-booting) may allow security to be circumvented on a secure system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Ensure Windows Server 2012 is the only operating system installed for the system to boot into. Remove alternate operating systems.Verify the local system boots directly into Windows. Open Control Panel. Select "System". Select the "Advanced System Settings" link. Select the "Advanced" tab. -Click the "Startup and Recovery" Settings button. +Click the "Startup and Recovery" Settings button. If the drop-down list box "Default operating system:" shows any operating system other than Windows Server 2012, this is a finding.Prohibited FTP Logins<GroupDescription></GroupDescription>WN12-GE-000026File Transfer Protocol (FTP) servers must be configured to prevent anonymous logons.<VulnDiscussion>The FTP service allows remote users to access shared files and directories. Allowing anonymous FTP connections makes user auditing difficult. @@ -243,7 +243,7 @@ For any sites that reference FTP, view the Binding information for IP address an Open a "Command Prompt". -Access the FTP site and review accessible directories with the following commands: +Access the FTP site and review accessible directories with the following commands: Note: Returned results may vary depending on the FTP server software. @@ -275,7 +275,7 @@ For domain-joined member servers, replace the Domain Admins group with a domain Remove any standard user accounts.Review the local Administrators group. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group. -For domain-joined member servers, the Domain Admins group must be replaced by a domain member server administrator group. +For domain-joined member servers, the Domain Admins group must be replaced by a domain member server administrator group. Standard user accounts must not be members of the local Administrator group. @@ -285,23 +285,23 @@ The built-in Administrator account or other required administrative accounts wou Security configuration tools that are integrated into Windows, such as Group Policies and Security Templates, may be used to configure platforms for security compliance. -If an alternate method is used to configure a system (e.g., manually using the DISA Windows Security STIGs, etc.) and the same configured result is achieved, this is acceptable.Printer Share Permissions<GroupDescription></GroupDescription>WN12-GE-000012Nonadministrative user accounts or groups must only have print permissions on printer shares.<VulnDiscussion>Windows shares are a means by which files, folders, printers, and other resources can be published for network users to access. Improper configuration can permit access to devices and data beyond a user's need.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000213Configure the permissions on shared printers to restrict standard users to only have Print permissions. This is typically given through the Everyone group by default.Open "Devices and Printers" in Control Panel or through Search. -If there are no printers configured, this is NA. +If an alternate method is used to configure a system (e.g., manually using the DISA Windows Security STIGs, etc.) and the same configured result is achieved, this is acceptable.Printer Share Permissions<GroupDescription></GroupDescription>WN12-GE-000012Nonadministrative user accounts or groups must only have print permissions on printer shares.<VulnDiscussion>Windows shares are a means by which files, folders, printers, and other resources can be published for network users to access. Improper configuration can permit access to devices and data beyond a user's need.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000213Configure the permissions on shared printers to restrict standard users to only have Print permissions. This is typically given through the Everyone group by default.Open "Devices and Printers" in Control Panel or through Search. +If there are no printers configured, this is NA.(Exclude Microsoft Print to PDF and Microsoft XPS Document Writer, which do not support sharing.) For each configured printer: -Right click on the printer. -Select "Printer Properties". -Select the "Sharing" tab. -View whether "Share this printer" is checked. +Right click on the printer. +Select "Printer Properties". +Select the "Sharing" tab. +View whether "Share this printer" is checked. -For any printers with "Share this printer" selected: -Select the Security tab. +For any printers with "Share this printer" selected: +Select the Security tab. If any standard user accounts or groups have permissions other than "Print", this is a finding. Standard users will typically be given "Print" permission through the Everyone group. "All APPLICATION PACKAGES" and "CREATOR OWNER" are not considered standard user accounts for this requirement.Forcibly Disconnect when Logon Hours Expire<GroupDescription></GroupDescription>WN12-SO-000034Users must be forcibly disconnected when their logon hours expire.<VulnDiscussion>Users must not be permitted to remain logged on to the network after they have exceeded their permitted logon hours. In many cases, this indicates that a user forgot to log off before leaving for the day. However, it may also indicate that a user is attempting unauthorized access at a time when the system may be less closely monitored. Forcibly disconnecting users when logon hours expire protects critical and sensitive network data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24148-9CCI-001133Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network server: Disconnect clients when logon hours expire" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: EnableForcedLogoff @@ -341,7 +341,7 @@ If the value for "Password must meet complexity requirements" is not set to "Ena Note: If an external password filter is in use that enforces all 4 character types and requires this setting be set to "Disabled", this would not be considered a finding. If this setting does not affect the use of an external password filter, it must be enabled for fallback purposes.Secure Print Driver Installation<GroupDescription></GroupDescription>WN12-SO-000089The print driver installation privilege must be restricted to administrators.<VulnDiscussion>Allowing users to install drivers can introduce malware or cause the instability of a system. Print driver installation should be restricted to administrators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25176-9CCI-001812Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Devices: Prevent users from installing printer drivers" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\ Value Name: AddPrinterDrivers @@ -386,7 +386,7 @@ Value Name: LmCompatibilityLevel Value Type: REG_DWORD Value: 5Ctrl+Alt+Del Security Attention Sequence<GroupDescription></GroupDescription>WN12-SO-000019The Ctrl+Alt+Del security attention sequence for logons must be enabled.<VulnDiscussion>Disabling the Ctrl+Alt+Del security attention sequence can compromise system security. Because only Windows responds to the Ctrl+Alt+Del security sequence, a user can be assured that any passwords entered following that sequence are sent only to Windows. If the sequence requirement is eliminated, malicious programs can request and receive a user's Windows password. Disabling this sequence also suppresses a custom logon banner.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25803-8CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive Logon: Do not require CTRL+ALT+DEL" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: DisableCAD @@ -430,9 +430,9 @@ Guests group Note: Windows Server 2012 R2 added new built-in security groups, "Local account" and "Local account and member of Administrators group". "Local account" is more restrictive but may cause issues on servers such as systems that provide Failover Clustering. Microsoft Security Advisory Patch 2871997 adds the new security groups to Windows Server 2012.Smart Card Removal Option <GroupDescription></GroupDescription>WN12-SO-000027The Smart Card removal option must be configured to Force Logoff or Lock Workstation.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked. Configuring a system to lock when a smart card is removed will ensure the system is inaccessible when unattended.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24154-7CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive logon: Smart card removal behavior" to "Lock Workstation" or "Force Logoff".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ - + Value Name: SCRemoveOption Value Type: REG_SZ @@ -440,7 +440,7 @@ Value: 1 (Lock Workstation) or 2 (Force Logoff) If configuring this on servers causes issues such as terminating users' remote sessions and the site has a policy in place that any other sessions on the servers such as administrative console logons, are manually locked or logged off when unattended or not in use, this would be acceptable. This must be documented with the ISSO.SMB Server Packet Signing (if client agrees)<GroupDescription></GroupDescription>WN12-SO-000033The Windows SMB server must perform SMB packet signing when possible.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will negotiate SMB packet signing as requested by the client.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24354-3CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network server: Digitally sign communications (if client agrees)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: EnableSecuritySignature @@ -468,7 +468,7 @@ Value: 1 If the value for "Domain Member: Digitally encrypt or sign secure channel data (always)" is set to "Enabled", this can be NA (see V-6831).Computer Account Password Reset<GroupDescription></GroupDescription>WN12-SO-000015The computer account password must not be prevented from being reset.<VulnDiscussion>Computer account passwords are changed automatically on a regular basis. Disabling automatic password changes can make the system more vulnerable to malicious access. Frequent password changes can be a significant safeguard for your system. A new password for the computer account will be generated every 30 days.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24243-8CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain member: Disable machine account password changes" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: DisablePasswordChange @@ -476,7 +476,7 @@ Value Name: DisablePasswordChange Value Type: REG_DWORD Value: 0SMB Client Packet Signing (if server agrees)<GroupDescription></GroupDescription>WN12-SO-000029The Windows SMB client must be enabled to perform SMB packet signing when possible.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. If this policy is enabled, the SMB client will request packet signing when communicating with an SMB server that is enabled or required to perform SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24740-3CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network client: Digitally sign communications (if server agrees)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\LanmanWorkstation\Parameters\ Value Name: EnableSecuritySignature @@ -486,7 +486,7 @@ Value: 1Members Any accounts that are members of the Backup Operators group, including application accounts, must be documented with the ISSO. If documentation of accounts that are members of the Backup Operators group is not maintained this is a finding.</check-content></check></Rule></Group><Group id="V-1171"><title>Format and Eject Removable Media<GroupDescription></GroupDescription>WN12-SO-000011Ejection of removable NTFS media must be restricted to Administrators.<VulnDiscussion>Removable hard drives, if they are not properly configured, can be formatted and ejected by users who are not members of the Administrators Group. Formatting and ejecting removable NTFS media must only be done by administrators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25217-1CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Devices: Allowed to format and eject removable media" to "Administrators".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value Name: AllocateDASD @@ -494,7 +494,7 @@ Value Name: AllocateDASD Value Type: REG_SZ Value: 0Password Expiration Warning<GroupDescription></GroupDescription>WN12-SO-000025Users must be warned in advance of their passwords expiring.<VulnDiscussion>Creating strong passwords that can be remembered by users requires some thought. By giving the user advance warning, the user has time to construct a sufficiently strong password. This setting configures the system to display a warning to users telling them how many days are left before their password expires.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23704-0CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive Logon: Prompt user to change password before expiration" to "14" days or more.If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value Name: PasswordExpiryWarning @@ -502,7 +502,7 @@ Value Name: PasswordExpiryWarning Value Type: REG_DWORD Value: 14 (or greater)Global System Objects Permission Strength<GroupDescription></GroupDescription>WN12-SO-000076The default permissions of global system objects must be increased.<VulnDiscussion>Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default DACL that specifies who can access the objects with what permissions. If this policy is enabled, the default DACL is stronger, allowing nonadministrative users to read shared objects, but not modify shared objects that they did not create.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24633-0CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Session Manager\ Value Name: ProtectionMode @@ -547,9 +547,9 @@ If the file shares have not been reconfigured to restrict permissions to the spe Select the "Security" tab. -If the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.Intrusion Detection System<GroupDescription></GroupDescription>WN12-GE-000022Servers must have a host-based Intrusion Detection System.<VulnDiscussion>A properly configured host-based Intrusion Detection System provides another level of defense against unauthorized access to critical servers. With proper configuration and logging enabled, such a system can stop and/or alert for many attempts to gain unauthorized access to resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance>This finding can be downgraded to a CAT III, if there is an active JIDS or firewall protecting the network. </SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Install a host-based Intrusion Detection System on each server.Determine whether there is a host-based Intrusion Detection System on each server. +If the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.Intrusion Detection System<GroupDescription></GroupDescription>WN12-GE-000022Servers must have a host-based Intrusion Detection System.<VulnDiscussion>A properly configured host-based Intrusion Detection System provides another level of defense against unauthorized access to critical servers. With proper configuration and logging enabled, such a system can stop and/or alert for many attempts to gain unauthorized access to resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance>This finding can be downgraded to a CAT III, if there is an active JIDS or firewall protecting the network. </SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Install a host-based Intrusion Detection System on each server.Determine whether there is a host-based Intrusion Detection System on each server. -If the HIPS component of HBSS is installed and active on the host and the Alerts of blocked activity are being logged and monitored, this will meet the requirement of this finding. +If the HIPS component of HBSS is installed and active on the host and the Alerts of blocked activity are being logged and monitored, this will meet the requirement of this finding. A HID device is not required on a system that has the role as the Network Intrusion Device (NID). However, this exception needs to be documented with the site ISSO. @@ -560,7 +560,7 @@ Navigate to Local Computer Policy -> Computer Configuration -> Windows Set If the value for "Network access: Allow anonymous SID/Name translation" is not set to "Disabled", this is a finding.Anonymous Access to Named Pipes<GroupDescription></GroupDescription>WN12-SO-000055-MSNamed pipes that can be accessed anonymously must be configured to contain no values on member servers.<VulnDiscussion>Named pipes that can be accessed anonymously provide the potential for gaining unauthorized system access. Pipes are internal system communications processes. They are identified internally by ID numbers that vary between systems. To make access to these processes easier, these pipes are given names that do not vary between systems. This setting controls which of these pipes anonymous users may access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25466-4CCI-001090Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Named pipes that can be accessed anonymously" to be defined but containing no entries (blank).If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: NullSessionPipes @@ -570,11 +570,11 @@ Value: (blank) Legitimate applications may add entries to this registry value. If an application requires these entries to function properly and is documented with the ISSO, this would not be a finding. Documentation must contain supporting information from the vendor's instructions.Remotely Accessible Registry Paths<GroupDescription></GroupDescription>WN12-SO-000056Unauthorized remotely accessible registry paths must not be configured.<VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Some processes may require remote access to the registry. This setting controls which registry paths are accessible from a remote computer. These registry paths must be limited, as they could give unauthorized individuals access to the registry.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23899-8CCI-001090Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Remotely accessible registry paths" with the following entries: -System\CurrentControlSet\Control\ProductOptions -System\CurrentControlSet\Control\Server Applications +System\CurrentControlSet\Control\ProductOptions +System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersionIf the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths\ Value Name: Machine @@ -582,15 +582,15 @@ Value Name: Machine Value Type: REG_MULTI_SZ Value: see below -System\CurrentControlSet\Control\ProductOptions -System\CurrentControlSet\Control\Server Applications +System\CurrentControlSet\Control\ProductOptions +System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion Legitimate applications may add entries to this registry value. If an application requires these entries to function properly and is documented with the ISSO, this would not be a finding. Documentation must contain supporting information from the vendor's instructions.Anonymous Access to Network Shares<GroupDescription></GroupDescription>WN12-SO-000059Network shares that can be accessed anonymously must not be allowed.<VulnDiscussion>Anonymous access to network shares provides the potential for gaining unauthorized system access by network users. This could lead to the exposure or corruption of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25592-7CCI-001090Ensure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Shares that can be accessed anonymously" contains no entries (blank).If the following registry value does not exist, this is not a finding: If the following registry value does exist and is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: NullSessionShares @@ -598,15 +598,15 @@ Value Name: NullSessionShares Value Type: REG_MULTI_SZ Value: (Blank)Remote Assistance - Solicit Remote Assistance<GroupDescription></GroupDescription>WN12-CC-000059Solicited Remote Assistance must not be allowed.<VulnDiscussion>Remote assistance allows another user to view or take control of the local session of a user. Solicited assistance is help that is specifically requested by the local user. This may allow unauthorized parties access to the resources on the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25590-1CCI-001090Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Remote Assistance -> "Configure Solicited Remote Assistance" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fAllowToGetHelp - -Type: REG_DWORD + +Type: REG_DWORD Value: 0Limit Blank Passwords<GroupDescription></GroupDescription>WN12-SO-000004Local accounts with blank passwords must be restricted to prevent access from the network.<VulnDiscussion>An account without a password can allow unauthorized access to a system as only the username would be required. Password policies should prevent accounts with blank passwords from existing on a system. However, if a local account with a blank password did exist, enabling this setting will prevent network access, limiting the account to local console logon only.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25589-3CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Accounts: Limit local account use of blank passwords to console logon only" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: LimitBlankPasswordUse @@ -614,7 +614,7 @@ Value Name: LimitBlankPasswordUse Value Type: REG_DWORD Value: 1Maximum Machine Account Password Age<GroupDescription></GroupDescription>WN12-SO-000016The maximum age for machine account passwords must be set to requirements.<VulnDiscussion>Computer account passwords are changed automatically on a regular basis. This setting controls the maximum password age that a machine account may have. This setting must be set to no more than 30 days, ensuring the machine changes its password monthly.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23596-0CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain member: Maximum machine account password age" to "30" or less (excluding "0" which is unacceptable).If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: MaximumPasswordAge @@ -622,25 +622,17 @@ Value Name: MaximumPasswordAge Value Type: REG_DWORD Value: 30 (or less, but not 0)Strong Session Key<GroupDescription></GroupDescription>WN12-SO-000017The system must be configured to require a strong session key.<VulnDiscussion>A computer connecting to a domain controller will establish a secure channel. Requiring strong session keys enforces 128-bit encryption between systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25198-3CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain member: Require strong (Windows 2000 or Later) session key" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: RequireStrongKey Value Type: REG_DWORD Value: 1 - -This setting may prevent a system from being joined to a domain if not configured consistently between systems.Storage of Passwords and Credentials<GroupDescription></GroupDescription>WN12-SO-000053The system must be configured to prevent the storage of passwords and credentials.<VulnDiscussion>This setting controls the storage of passwords and credentials for network authentication on the local system. Such credentials must not be stored on the local machine, as that may lead to account compromise.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23358-5CCI-002038Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Do not allow storage of passwords and credentials for network authentication" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Lsa\ - -Value Name: DisableDomainCreds +This setting may prevent a system from being joined to a domain if not configured consistently between systems.Everyone Anonymous rights<GroupDescription></GroupDescription>WN12-SO-000054The system must be configured to prevent anonymous users from having the same rights as the Everyone group.<VulnDiscussion>Access by anonymous users must be restricted. If this setting is enabled, then anonymous users have the same rights and permissions as the built-in Everyone group. Anonymous users must not have these permissions or rights.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23807-1CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Let everyone permissions apply to anonymous users" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Value Type: REG_DWORD -Value: 1Everyone Anonymous rights<GroupDescription></GroupDescription>WN12-SO-000054The system must be configured to prevent anonymous users from having the same rights as the Everyone group.<VulnDiscussion>Access by anonymous users must be restricted. If this setting is enabled, then anonymous users have the same rights and permissions as the built-in Everyone group. Anonymous users must not have these permissions or rights.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23807-1CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Let everyone permissions apply to anonymous users" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: EveryoneIncludesAnonymous @@ -648,7 +640,7 @@ Value Name: EveryoneIncludesAnonymous Value Type: REG_DWORD Value: 0Sharing and Security Model for Local Accounts<GroupDescription></GroupDescription>WN12-SO-000060The system must be configured to use the Classic security model.<VulnDiscussion>Windows includes two network-sharing security models - Classic and Guest only. With the Classic model, local accounts must be password protected; otherwise, anyone can use guest user accounts to access shared system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-22742-1CCI-001090Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Sharing and security model for local accounts" to "Classic - local users authenticate as themselves".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: ForceGuest @@ -656,7 +648,7 @@ Value Name: ForceGuest Value Type: REG_DWORD Value: 0LAN Manager Hash stored<GroupDescription></GroupDescription>WN12-SO-000065The system must be configured to prevent the storage of the LAN Manager hash of passwords.<VulnDiscussion>The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords. This setting controls whether or not a LAN Manager hash of the password is stored in the SAM the next time the password is changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24150-5CCI-000196Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Do not store LAN Manager hash value on next password change" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: NoLMHash @@ -669,7 +661,7 @@ Navigate to Local Computer Policy -> Computer Configuration -> Windows Set If the value for "Network security: Force logoff when logon hours expire" is not set to "Enabled", this is a finding.LDAP Client Signing<GroupDescription></GroupDescription>WN12-SO-000068The system must be configured to the required LDAP client signing level.<VulnDiscussion>This setting controls the signing requirements for LDAP clients. This setting must be set to Negotiate signing or Require signing, depending on the environment and type of LDAP server in use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25245-2CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: LDAP client signing requirements" to "Negotiate signing" at a minimum.If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\LDAP\ Value Name: LDAPClientIntegrity @@ -677,7 +669,7 @@ Value Name: LDAPClientIntegrity Value Type: REG_DWORD Value: 1Session Security for NTLM SSP Based Clients<GroupDescription></GroupDescription>WN12-SO-000069The system must be configured to meet the minimum session security requirement for NTLM SSP-based clients.<VulnDiscussion>Microsoft has implemented a variety of security support providers for use with RPC sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24783-3CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Minimum session security for NTLM SSP based (including secure RPC) clients" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected).If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\MSV1_0\ Value Name: NTLMMinClientSec @@ -692,23 +684,23 @@ Value Name: Enabled Value Type: REG_DWORD Value: 1 - + Warning: Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms. Both the browser and web server must be configured to use TLS, or the browser will not be able to connect to a secure site.Case Insensitivity for Non-Windows<GroupDescription></GroupDescription>WN12-SO-000075The system must be configured to require case insensitivity for non-Windows subsystems.<VulnDiscussion>This setting controls the behavior of non-Windows subsystems when dealing with the case of arguments or commands. Case sensitivity could lead to the access of files or commands that must be restricted. To prevent this from happening, case insensitivity restrictions must be required.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24870-8CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "System objects: Require case insensitivity for non-Windows subsystems" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Session Manager\Kernel\ Value Name: ObCaseInsensitive Value Type: REG_DWORD -Value: 1TS/RDS - Session Limit<GroupDescription></GroupDescription>WN12-CC-000131Remote Desktop Services must limit users to one remote session.<VulnDiscussion>Allowing multiple Remote Desktop Services sessions could consume resources. There is also potential to make a secondary connection to a system with compromised credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLO-1, ECLO-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23328-8CCI-000054Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Connections -> "Restrict Remote Desktop Services users to a single Remote Desktop Services Session" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: +Value: 1TS/RDS - Session Limit<GroupDescription></GroupDescription>WN12-CC-000131Remote Desktop Services must limit users to one remote session.<VulnDiscussion>Allowing multiple Remote Desktop Services sessions could consume resources. There is also potential to make a secondary connection to a system with compromised credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLO-1, ECLO-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23328-8CCI-000054Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Connections -> "Restrict Remote Desktop Services users to a single Remote Desktop Services Session" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ -Value Name: fSingleSessionPerUser +Value Name: fSingleSessionPerUser -Type: REG_DWORD +Type: REG_DWORD Value: 1TS/RDS - Password Prompting<GroupDescription></GroupDescription>WN12-CC-000099Remote Desktop Services must always prompt a client for passwords upon connection.<VulnDiscussion>This setting controls the ability of users to supply passwords automatically as part of their remote desktop connection. Disabling this setting would allow anyone to use the stored credentials in a connection item to connect to the terminal server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25016-7CCI-002038Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security -> "Always prompt for password upon connection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -759,7 +751,7 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fAllowUnsolicited Type: REG_DWORD -Value: 0Windows Time Service - Configure NTP Client<GroupDescription></GroupDescription>WN12-CC-000069The time service must synchronize with an appropriate DoD time source.<VulnDiscussion>The Windows Time Service controls time synchronization settings. Time synchronization is essential for authentication and auditing purposes. If the Windows Time Service is used, it must synchronize with a secure, authorized time source. Domain-joined systems are automatically configured to synchronize with domain controllers. If an NTP server is configured, it must synchronize with a secure, authorized time source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23563-0CCI-001891If the system needs to be configured to an NTP server, configure the system to point to an authorized time server by setting the policy value for Computer Configuration >> Administrative Templates >> System >> Windows Time Service >> Time Providers >> "Configure Windows NTP Client" to "Enabled", and configure the "NtpServer" field to point to an authorized time server. +Value: 0Windows Time Service - Configure NTP Client<GroupDescription></GroupDescription>WN12-CC-000069The time service must synchronize with an appropriate DoD time source.<VulnDiscussion>The Windows Time Service controls time synchronization settings. Time synchronization is essential for authentication and auditing purposes. If the Windows Time Service is used, it must synchronize with a secure, authorized time source. Domain-joined systems are automatically configured to synchronize with domain controllers. If an NTP server is configured, it must synchronize with a secure, authorized time source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23563-0CCI-001891If the system needs to be configured to an NTP server, configure the system to point to an authorized time server by setting the policy value for Computer Configuration >> Administrative Templates >> System >> Windows Time Service >> Time Providers >> "Configure Windows NTP Client" to "Enabled", and configure the "NtpServer" field to point to an authorized time server. The US Naval Observatory operates stratum 1 time servers, identified at http://tycho.usno.navy.mil/ntp.html. Time synchronization will occur through a hierarchy of time servers down to the local level. Clients and lower-level servers will synchronize with an authorized time server in the hierarchy.Open "Windows PowerShell" or an elevated "Command Prompt" (run as administrator). @@ -775,7 +767,7 @@ The US Naval Observatory operates stratum 1 time servers, identified at http://t (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Session Manager\ Value Name: SafeDllSearchMode @@ -791,7 +783,7 @@ Registry Path: \Software\Policies\Microsoft\WindowsMediaPlayer\ Value Name: DisableAutoupdate Type: REG_DWORD -Value: 1Media Player - Prevent Codec Download<GroupDescription></GroupDescription>WN12-UC-000013Media Player must be configured to prevent automatic Codec downloads.<VulnDiscussion>The Windows Media Player uses software components, referred to as Codecs, to play back media files. By default, when an unknown file type is opened with the Media Player, it will search the Internet for the appropriate Codec and automatically download it. To ensure platform consistency and to protect against new vulnerabilities associated with media types, all Codecs must be installed by the System Administrator.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23890-7CCI-001812Configure the policy value for User Configuration -> Administrative Templates -> Windows Components -> Windows Media Player -> Playback -> "Prevent Codec Download" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: +Value: 1Media Player - Prevent Codec Download<GroupDescription></GroupDescription>WN12-UC-000013Media Player must be configured to prevent automatic Codec downloads.<VulnDiscussion>The Windows Media Player uses software components, referred to as Codecs, to play back media files. By default, when an unknown file type is opened with the Media Player, it will search the Internet for the appropriate Codec and automatically download it. To ensure platform consistency and to protect against new vulnerabilities associated with media types, all Codecs must be installed by the System Administrator.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23890-7CCI-001812Configure the policy value for User Configuration -> Administrative Templates -> Windows Components -> Windows Media Player -> Playback -> "Prevent Codec Download" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER Registry Path: \Software\Policies\Microsoft\WindowsMediaPlayer\ @@ -938,7 +930,7 @@ Wired AutoConfig - Manual WMI Performance Adapter - Manual Workstation - AutomaticSession Security for NTLM SSP based Servers<GroupDescription></GroupDescription>WN12-SO-000070The system must be configured to meet the minimum session security requirement for NTLM SSP-based servers.<VulnDiscussion>Microsoft has implemented a variety of security support providers for use with RPC sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25264-3CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network security: Minimum session security for NTLM SSP based (including secure RPC) servers" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected).If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\MSV1_0\ Value Name: NTLMMinServerSec @@ -950,7 +942,7 @@ Value: 0x20080000 (537395200)If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: DisableIPSourceRouting @@ -970,7 +962,7 @@ Value: 2Disable (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)</fixtext><fix id="F-45851r2_fix" /><check system="C-47230r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_2012_MS_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: EnableICMPRedirect @@ -980,7 +972,7 @@ Value: 0</check-content></check></Rule></Group><Group id="V-4112"><title>Disable (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)</fixtext><fix id="F-45852r2_fix" /><check system="C-47231r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_2012_MS_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: PerformRouterDiscovery @@ -990,13 +982,13 @@ Value: 0</check-content></check></Rule></Group><Group id="V-4113"><title>TCP Con (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)</fixtext><fix id="F-45853r2_fix" /><check system="C-47232r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_2012_MS_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: KeepAliveTime Value Type: REG_DWORD -Value: 300000 (or less)</check-content></check></Rule></Group><Group id="V-4116"><title>Name-Release Attacks<GroupDescription></GroupDescription>WN12-SO-000043The system must be configured to ignore NetBIOS name release requests except from WINS servers.<VulnDiscussion>Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the servers WINS resolution capability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23715-6CCI-002385Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers" to "Enabled". +Value: 300000 (or less)Name-Release Attacks<GroupDescription></GroupDescription>WN12-SO-000043The system must be configured to ignore NetBIOS name release requests except from WINS servers.<VulnDiscussion>Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the servers WINS resolution capability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23715-6CCI-002385Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers" to "Enabled". (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: @@ -1006,7 +998,7 @@ Registry Path: \SYSTEM\CurrentControlSet\Services\Netbt\Parameters\ Value Name: NoNameReleaseOnDemand Value Type: REG_DWORD -Value: 1TCP Data Retransmissions<GroupDescription></GroupDescription>WN12-SO-000048The system must limit how many times unacknowledged TCP data is retransmitted.<VulnDiscussion>In a SYN flood attack, the attacker sends a continuous stream of SYN packets to a server, and the server leaves the half-open connections open until it is overwhelmed and is no longer able to respond to legitimate requests.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25455-7CCI-002385Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)" to "3" or less. +Value: 1TCP Data Retransmissions<GroupDescription></GroupDescription>WN12-SO-000048The system must limit how many times unacknowledged TCP data is retransmitted.<VulnDiscussion>In a SYN flood attack, the attacker sends a continuous stream of SYN packets to a server, and the server leaves the half-open connections open until it is overwhelmed and is no longer able to respond to legitimate requests.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25455-7CCI-002385Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted (3 recommended, 5 is default)" to "3" or less. (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)If the following registry value does not exist or is not configured as specified, this is a finding: @@ -1020,7 +1012,7 @@ Value: 3 (or less)If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value Name: ScreenSaverGracePeriod @@ -1040,7 +1032,7 @@ System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration System\CurrentControlSet\Services\Eventlog System\CurrentControlSet\Services\SysmonlogIf the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths\ Value Name: Machine @@ -1062,7 +1054,7 @@ System\CurrentControlSet\Services\Sysmonlog Legitimate applications may add entries to this registry value. If an application requires these entries to function properly and is documented with the ISSO, this would not be a finding. Documentation must contain supporting information from the vendor's instructions.Optional Subsystems<GroupDescription></GroupDescription>WN12-SO-000088Optional Subsystems must not be permitted to operate on the system.<VulnDiscussion>The POSIX subsystem is an Institute of Electrical and Electronic Engineers (IEEE) standard that defines a set of operating system services. The POSIX Subsystem is required if the server supports applications that use that subsystem. The subsystem introduces a security risk relating to processes that can potentially persist across logins. That is, if a user starts a process and then logs out, there is a potential that the next user who logs in to the system could access the previous users process. This is dangerous because the process started by the first user may retain that users system privileges, and anything the second user does with that process will be performed with the privileges of the first user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools>HK</ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24878-1CCI-000381Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "System settings: Optional subsystems" to "Blank" (Configured with no entries).If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Session Manager\Subsystems\ Value Name: Optional @@ -1086,7 +1078,7 @@ Value Name: NoGPOListChanges Type: REG_DWORD Value: 0Encrypting and Signing of Secure Channel Traffic<GroupDescription></GroupDescription>WN12-SO-000012Outgoing secure channel traffic must be encrypted or signed.<VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted and signed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24465-7CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Domain member: Digitally encrypt or sign secure channel data (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: RequireSignOrSeal @@ -1094,7 +1086,7 @@ Value Name: RequireSignOrSeal Value Type: REG_DWORD Value: 1SMB Client Packet Signing (Always)<GroupDescription></GroupDescription>WN12-SO-000028The Windows SMB client must be configured to always perform SMB packet signing.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24969-8CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network client: Digitally sign communications (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\LanmanWorkstation\Parameters\ Value Name: RequireSecuritySignature @@ -1102,7 +1094,7 @@ Value Name: RequireSecuritySignature Value Type: REG_DWORD Value: 1SMB Server Packet Signing (Always)<GroupDescription></GroupDescription>WN12-SO-000032The Windows SMB server must be configured to always perform SMB packet signing.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23716-4CCI-002418CCI-002421Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network server: Digitally sign communications (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RequireSecuritySignature @@ -1110,7 +1102,7 @@ Value Name: RequireSecuritySignature Value Type: REG_DWORD Value: 1Anonymous Access to Named Pipes and Shares<GroupDescription></GroupDescription>WN12-SO-000058Anonymous access to Named Pipes and Shares must be restricted.<VulnDiscussion>Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access. This setting restricts access to those defined in "Network access: Named Pipes that can be accessed anonymously" and "Network access: Shares that can be accessed anonymously", both of which must be blank under other requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24564-7CCI-001090Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Restrict anonymous access to Named Pipes and Shares" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RestrictNullSessAccess @@ -1142,9 +1134,9 @@ Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordExpires=False a Exclude application accounts and disabled accounts (e.g., Guest). -If any enabled user accounts are returned with a "PasswordExpires" status of "False", this is a finding.Password Requirement<GroupDescription></GroupDescription>WN12-GE-000015Windows 2012/2012 R2 accounts must be configured to require passwords.<VulnDiscussion>The lack of password protection enables anyone to gain access to the information system, which opens a backdoor opportunity for intruders to compromise the system as well as other resources. Accounts on a system must require passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000764Configure all enabled accounts to require passwords. +If any enabled user accounts are returned with a "PasswordExpires" status of "False", this is a finding.Password Requirement<GroupDescription></GroupDescription>WN12-GE-000015Windows 2012/2012 R2 accounts must be configured to require passwords.<VulnDiscussion>The lack of password protection enables anyone to gain access to the information system, which opens a backdoor opportunity for intruders to compromise the system as well as other resources. Accounts on a system must require passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000764Configure all enabled accounts to require passwords. -The password required flag can be set by entering the following on a command line: "Net user [username] /passwordreq:yes", substituting [username] with the name of the user account.Review the password required status for enabled user accounts. +The password required flag can be set by entering the following on a command line: "Net user [username] /passwordreq:yes", substituting [username] with the name of the user account.Review the password required status for enabled user accounts. Open "Windows PowerShell". @@ -1152,7 +1144,7 @@ Domain Controllers: Enter "Get-ADUser -Filter * -Properties PasswordNotRequired | Where PasswordNotRequired -eq True | FT Name, PasswordNotRequired, Enabled". -Exclude disabled accounts (e.g., Guest). +Exclude disabled accounts (e.g., Guest) and Trusted Domain Objects (TDOs). If "PasswordNotRequired" is "True" for any enabled user account, this is a finding. @@ -1164,7 +1156,7 @@ Exclude disabled accounts (e.g., Guest). If any enabled user accounts are returned with a "PasswordRequired" status of "False", this is a finding.Display of Last User Name<GroupDescription></GroupDescription>WN12-SO-000018The system must be configured to prevent the display of the last username on the logon screen.<VulnDiscussion>Displaying the username of the last logged on user provides half of the userid/password equation that an unauthorized person would need to gain access. The username of the last user to log on to a system must not be displayed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24748-6CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive logon: Do not display last user name" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: DontDisplayLastUserName @@ -1195,25 +1187,25 @@ Enter 'Net User [account name] | Find /i "Password Last Set"', where [account na If the "PasswordLastSet" date is greater than one year old, this is a finding.Audit Access of Global System Objects<GroupDescription></GroupDescription>WN12-SO-000007Auditing the Access of Global System Objects must be turned off.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. This setting prevents the system from setting up a default system access control list for certain system objects, which could create a very large number of security events, filling the security log in Windows and making it difficult to identify actual issues.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24075-4CCI-001095Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Audit: Audit the access of global system objects" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: AuditBaseObjects Value Type: REG_DWORD -Value: 0Audit Backup and Restore Privileges<GroupDescription></GroupDescription>WN12-SO-000008Auditing of Backup and Restore Privileges must be turned off.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. +Value: 0Audit Backup and Restore Privileges<GroupDescription></GroupDescription>WN12-SO-000008Auditing of Backup and Restore Privileges must be turned off.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. This setting prevents the system from generating audit events for every file backed up or restored, which could fill the security log in Windows, making it difficult to identify actual issues.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24923-5CCI-001095Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Audit: Audit the use of Backup and Restore privilege" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: FullPrivilegeAuditing Value Type: REG_BINARY -Value: 0Audit Policy Subcategory Setting<GroupDescription></GroupDescription>WN12-SO-000009Audit policy using subcategories must be enabled.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. +Value: 0Audit Policy Subcategory Setting<GroupDescription></GroupDescription>WN12-SO-000009Audit policy using subcategories must be enabled.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. This setting allows administrators to enable more precise auditing capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24252-9CCI-000169Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: SCENoApplyLegacyAuditPolicy @@ -1223,7 +1215,7 @@ Value: 1IPSec (See "Updating the Windows Security Options File" in the STIG Overview document if MSS settings are not visible in the system's policy tools.)</fixtext><fix id="F-45871r2_fix" /><check system="C-47251r2_chk"><check-content-ref name="M" href="DPMS_XCCDF_Benchmark_Windows_2012_MS_STIG.xml" /><check-content>If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\IPSEC\ Value Name: NoDefaultExempt @@ -1235,7 +1227,7 @@ Configure the policy value for Computer Configuration -> Windows Settings -&g If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: FilterAdministratorToken @@ -1249,7 +1241,7 @@ More secure options for this setting would also be acceptable (e.g., Prompt for If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: ConsentPromptBehaviorAdmin @@ -1264,7 +1256,7 @@ Configure the policy value for Computer Configuration -> Windows Settings -&g If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: ConsentPromptBehaviorUser @@ -1276,7 +1268,7 @@ Configure the policy value for Computer Configuration -> Windows Settings -&g If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableInstallerDetection @@ -1288,7 +1280,7 @@ Configure the policy value for Computer Configuration -> Windows Settings -&g If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableSecureUIAPaths @@ -1300,7 +1292,7 @@ Configure the policy value for Computer Configuration -> Windows Settings -&g If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableLUA @@ -1312,7 +1304,7 @@ Configure the policy value for Computer Configuration -> Windows Settings -&g If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: PromptOnSecureDesktop @@ -1324,7 +1316,7 @@ Configure the policy value for Computer Configuration -> Windows Settings -&g If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableVirtualization @@ -1362,7 +1354,7 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Rpc\ Value Name: RestrictRemoteClients Type: REG_DWORD -Value: 1</check-content></check></Rule></Group><Group id="V-14259"><title>Printing Over HTTP<GroupDescription></GroupDescription>WN12-CC-000039Printing over HTTP must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 1Printing Over HTTP<GroupDescription></GroupDescription>WN12-CC-000039Printing over HTTP must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents the client computer from printing over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24832-8CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off printing over HTTP" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -1371,7 +1363,7 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Printers\ Value Name: DisableHTTPPrinting Type: REG_DWORD -Value: 1HTTP Printer Drivers<GroupDescription></GroupDescription>WN12-CC-000032Downloading print driver packages over HTTP must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 1HTTP Printer Drivers<GroupDescription></GroupDescription>WN12-CC-000032Downloading print driver packages over HTTP must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents the computer from downloading print driver packages over HTTP.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24854-2CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off downloading of print drivers over HTTP" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -1380,7 +1372,7 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Printers\ Value Name: DisableWebPnPDownload Type: REG_DWORD -Value: 1Windows Update Device Drive Searching<GroupDescription></GroupDescription>WN12-CC-000047Windows must be prevented from using Windows Update to search for drivers.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 1Windows Update Device Drive Searching<GroupDescription></GroupDescription>WN12-CC-000047Windows must be prevented from using Windows Update to search for drivers.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents Windows from searching Windows Update for device drivers when no local drivers for a device are present.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24071-3CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off Windows Update device driver searching" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -1445,7 +1437,7 @@ Registry Path: \Software\Policies\Microsoft\EventViewer\ Value Name: MicrosoftEventVwrDisableLinks Type: REG_DWORD -Value: 1Internet File Association Service <GroupDescription></GroupDescription>WN12-CC-000038The Internet File Association service must be turned off.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 1Internet File Association Service <GroupDescription></GroupDescription>WN12-CC-000038The Internet File Association service must be turned off.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents unhandled file associations from using the Microsoft Web service to find an application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24899-7CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off Internet File Association service" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -1494,7 +1486,7 @@ Registry Path: \Software\Policies\Microsoft\Windows\Installer\ Value Name: DisableLUAPatching Type: REG_DWORD -Value: 1Media Player – First Use Dialog Boxes <GroupDescription></GroupDescription>WN12-CC-000121Users must not be presented with Privacy and Installation options on first use of Windows Media Player.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 1Media Player – First Use Dialog Boxes <GroupDescription></GroupDescription>WN12-CC-000121Users must not be presented with Privacy and Installation options on first use of Windows Media Player.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents users from being presented with Privacy and Installation options on first use of Windows Media Player, which could enable some communication with the vendor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25014-2CCI-000366If Windows Media Player is installed, configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Media Player -> "Do Not Show First Use Dialog Boxes" to "Enabled".Windows Media Player is not installed by default. If it is not installed, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -1563,7 +1555,7 @@ Registry Path: \Software\Policies\Microsoft\Windows\DeviceInstall\Settings\ Value Name: DisableSystemRestore Type: REG_DWORD -Value: 0Device Install – Generic Driver Error Report<GroupDescription></GroupDescription>WN12-CC-000020An Error Report must not be sent when a generic device driver is installed.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 0Device Install – Generic Driver Error Report<GroupDescription></GroupDescription>WN12-CC-000020An Error Report must not be sent when a generic device driver is installed.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents an error report from being sent when a generic device driver is installed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23275-1CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Do not send a Windows error report when a generic driver is installed on a device" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -1572,7 +1564,7 @@ Registry Path: \Software\Policies\Microsoft\Windows\DeviceInstall\Settings\ Value Name: DisableSendGenericDriverNotFoundToWER Type: REG_DWORD -Value: 1Driver Install – Device Driver Search Prompt<GroupDescription></GroupDescription>WN12-CC-000026Users must not be prompted to search Windows Update for device drivers.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 1Driver Install – Device Driver Search Prompt<GroupDescription></GroupDescription>WN12-CC-000026Users must not be prompted to search Windows Update for device drivers.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents users from being prompted to search Windows Update for device drivers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24804-7CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Driver Installation -> "Turn off Windows Update device driver search prompt" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -1581,7 +1573,7 @@ Registry Path: \Software\Policies\Microsoft\Windows\DriverSearching\ Value Name: DontPromptForWindowsUpdate Type: REG_DWORD -Value: 1Handwriting Recognition Error Reporting<GroupDescription></GroupDescription>WN12-CC-000035Errors in handwriting recognition on tablet PCs must not be reported to Microsoft.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 1Handwriting Recognition Error Reporting<GroupDescription></GroupDescription>WN12-CC-000035Errors in handwriting recognition on tablet PCs must not be reported to Microsoft.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents errors in handwriting recognition on tablet PCs from being reported to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25580-2CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings -> "Turn off handwriting recognition error reporting" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -1622,7 +1614,7 @@ Registry Path: \Software\Policies\Microsoft\Windows\Explorer\ Value Name: NoHeapTerminationOnCorruption Type: REG_DWORD -Value: 0Media DRM – Internet Access<GroupDescription></GroupDescription>WN12-CC-000120Windows Media Digital Rights Management (DRM) must be prevented from accessing the Internet.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 0Media DRM – Internet Access<GroupDescription></GroupDescription>WN12-CC-000120Windows Media Digital Rights Management (DRM) must be prevented from accessing the Internet.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This check verifies that Windows Media DRM will be prevented from accessing the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24380-8CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Media Digital Rights Management -> "Prevent Windows Media DRM Internet Access" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -1639,25 +1631,25 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoInPlaceSharing Type: REG_DWORD -Value: 1Software Certificate Installation Files<GroupDescription></GroupDescription>WN12-GE-000020Software certificate installation files must be removed from Windows 2012/2012 R2.<VulnDiscussion>Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Remove any certificate installation files (*.p12 and *.pfx) found on a system. +Value: 1Software Certificate Installation Files<GroupDescription></GroupDescription>WN12-GE-000020Software certificate installation files must be removed from Windows 2012/2012 R2.<VulnDiscussion>Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Remove any certificate installation files (*.p12 and *.pfx) found on a system. -This does not apply to server-based applications that have a requirement for certificate files or non-certificate installation files with the same extension.Search all drives for *.p12 and *.pfx files. +This does not apply to server-based applications that have a requirement for certificate files, Adobe PreFlight certificate files, or non-certificate installation files with the same extension.Search all drives for *.p12 and *.pfx files. If any files with these extensions exist, this is a finding. -This does not apply to server-based applications that have a requirement for certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO.UAC - UIAccess Secure Desktop<GroupDescription></GroupDescription>WN12-SO-000086UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting prevents User Interface Accessibility programs from disabling the secure desktop for elevation prompts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECCD-1, ECCD-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23295-9CCI-001084UAC requirements are NA on Server Core installations. +This does not apply to server-based applications that have a requirement for certificate files or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO.UAC - UIAccess Secure Desktop<GroupDescription></GroupDescription>WN12-SO-000086UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting prevents User Interface Accessibility programs from disabling the secure desktop for elevation prompts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECCD-1, ECCD-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23295-9CCI-001084UAC requirements are NA on Server Core installations. Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop" to "Disabled".UAC requirements are NA on Server Core installations. If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableUIADesktopToggle Value Type: REG_DWORD -Value: 0TS/RDS – COM Port Redirection<GroupDescription></GroupDescription>WN12-CC-000132Users must be prevented from mapping local COM ports and redirecting data from the Remote Desktop Session Host to local COM ports. (Remote Desktop Services Role).<VulnDiscussion>Preventing the redirection of Remote Desktop session data to a client computer's COM ports helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24625-6CCI-002314Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow COM port redirection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: +Value: 0TS/RDS – COM Port Redirection<GroupDescription></GroupDescription>WN12-CC-000132Users must be prevented from mapping local COM ports and redirecting data from the Remote Desktop Session Host to local COM ports. (Remote Desktop Services Role).<VulnDiscussion>Preventing the redirection of Remote Desktop session data to a client computer's COM ports helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24625-6CCI-002314Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow COM port redirection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ @@ -1665,7 +1657,7 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fDisableCcm Type: REG_DWORD -Value: 1TS/RDS – LPT Port Redirection<GroupDescription></GroupDescription>WN12-CC-000133Users must be prevented from mapping local LPT ports and redirecting data from the Remote Desktop Session Host to local LPT ports. (Remote Desktop Services Role).<VulnDiscussion>Preventing the redirection of Remote Desktop session data to a client computer's LPT ports helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24381-6CCI-002314Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow LPT port redirection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: +Value: 1TS/RDS – LPT Port Redirection<GroupDescription></GroupDescription>WN12-CC-000133Users must be prevented from mapping local LPT ports and redirecting data from the Remote Desktop Session Host to local LPT ports. (Remote Desktop Services Role).<VulnDiscussion>Preventing the redirection of Remote Desktop session data to a client computer's LPT ports helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24381-6CCI-002314Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow LPT port redirection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ @@ -1673,7 +1665,7 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fDisableLPT Type: REG_DWORD -Value: 1TS/RDS - PNP Device Redirection<GroupDescription></GroupDescription>WN12-CC-000135Users must be prevented from redirecting Plug and Play devices to the Remote Desktop Session Host. (Remote Desktop Services Role).<VulnDiscussion>Preventing the redirection of Plug and Play devices in Remote Desktop sessions helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24708-0CCI-002314Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow supported Plug and Play device redirection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: +Value: 1TS/RDS - PNP Device Redirection<GroupDescription></GroupDescription>WN12-CC-000135Users must be prevented from redirecting Plug and Play devices to the Remote Desktop Session Host. (Remote Desktop Services Role).<VulnDiscussion>Preventing the redirection of Plug and Play devices in Remote Desktop sessions helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24708-0CCI-002314Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow supported Plug and Play device redirection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ @@ -1681,7 +1673,7 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fDisablePNPRedir Type: REG_DWORD -Value: 1TS/RDS – Smart Card Device Redirection<GroupDescription></GroupDescription>WN12-CC-000134The system must be configured to ensure smart card devices can be redirected to the Remote Desktop session. (Remote Desktop Services Role).<VulnDiscussion>Enabling the redirection of smart card devices allows their use within Remote Desktop sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24260-2CCI-002314Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow smart card device redirection" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: +Value: 1TS/RDS – Smart Card Device Redirection<GroupDescription></GroupDescription>WN12-CC-000134The system must be configured to ensure smart card devices can be redirected to the Remote Desktop session. (Remote Desktop Services Role).<VulnDiscussion>Enabling the redirection of smart card devices allows their use within Remote Desktop sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24260-2CCI-002314Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow smart card device redirection" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ @@ -1695,13 +1687,13 @@ Configure the policy value for Computer Configuration -> Windows Settings -&g If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: ValidateAdminCodeSignatures Value Type: REG_DWORD -Value: 0Windows Customer Experience Improvement Program <GroupDescription></GroupDescription>WN12-CC-000045The Windows Customer Experience Improvement Program must be disabled.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 0Windows Customer Experience Improvement Program <GroupDescription></GroupDescription>WN12-CC-000045The Windows Customer Experience Improvement Program must be disabled.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting ensures the Windows Customer Experience Improvement Program is disabled so information is not passed to the vendor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24082-0CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication Settings -> "Turn off Windows Customer Experience Improvement Program" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -1710,7 +1702,7 @@ Registry Path: \Software\Policies\Microsoft\SQMClient\Windows\ Value Name: CEIPEnable Type: REG_DWORD -Value: 0Help Experience Improvement Program <GroupDescription></GroupDescription>WN12-UC-000007The Windows Help Experience Improvement Program must be disabled.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 0Help Experience Improvement Program <GroupDescription></GroupDescription>WN12-UC-000007The Windows Help Experience Improvement Program must be disabled.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting ensures the Windows Help Experience Improvement Program is disabled to prevent information from being passed to the vendor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24925-0CCI-000381Configure the policy value for User Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication Settings -> "Turn off Help Experience Improvement Program" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER @@ -1719,7 +1711,7 @@ Registry Path: \Software\Policies\Microsoft\Assistance\Client\1.0\ Value Name: NoImplicitFeedback Type: REG_DWORD -Value: 1Help Ratings<GroupDescription></GroupDescription>WN12-UC-000008Windows Help Ratings feedback must be turned off.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 1Help Ratings<GroupDescription></GroupDescription>WN12-UC-000008Windows Help Ratings feedback must be turned off.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting ensures users cannot provide ratings feedback to Microsoft for Help content.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25470-6CCI-000381Configure the policy value for User Configuration -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication Settings -> "Turn off Help Ratings" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER @@ -1834,7 +1826,7 @@ Registry Path: \Software\Policies\Microsoft\Windows\TCPIP\v6Transition\ Value Name: Force_Tunneling Type: REG_SZ -Value: EnabledWindows Update Point and Print Driver Search<GroupDescription></GroupDescription>WN12-CC-000016Windows Update must be prevented from searching for point and print drivers.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: EnabledWindows Update Point and Print Driver Search<GroupDescription></GroupDescription>WN12-CC-000016Windows Update must be prevented from searching for point and print drivers.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting will prevent Windows from searching Windows Update for point and print drivers. Only the local driver store and server driver cache will be searched.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24139-8CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> Printers -> "Extend Point and Print connection to search Windows Update" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -1843,7 +1835,7 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Printers\ Value Name: DoNotInstallCompatibleDriverFromWindowsUpdate Type: REG_DWORD -Value: 1Prevent device metadata retrieval from Internet<GroupDescription></GroupDescription>WN12-CC-000022Device metadata retrieval from the Internet must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 1Prevent device metadata retrieval from Internet<GroupDescription></GroupDescription>WN12-CC-000022Device metadata retrieval from the Internet must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting will prevent Windows from retrieving device metadata from the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24165-3CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Installation >> "Prevent device metadata retrieval from the Internet" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -1852,7 +1844,7 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Device Metadata\ Value Name: PreventDeviceMetadataFromNetwork Value Type: REG_DWORD -Value: 1Prevent Windows Update for device driver search<GroupDescription></GroupDescription>WN12-CC-000024Device driver searches using Windows Update must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 1Prevent Windows Update for device driver search<GroupDescription></GroupDescription>WN12-CC-000024Device driver searches using Windows Update must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting will prevent the system from searching Windows Update for device drivers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24777-5CCI-001812Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Specify search order for device driver source locations" to "Enabled: Do not search Windows Update".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -1861,7 +1853,7 @@ Registry Path: \Software\Policies\Microsoft\Windows\DriverSearching\ Value Name: SearchOrderConfig Type: REG_DWORD -Value: 0MSDT Interactive Communication<GroupDescription></GroupDescription>WN12-CC-000066Microsoft Support Diagnostic Tool (MSDT) interactive communication with Microsoft must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 0MSDT Interactive Communication<GroupDescription></GroupDescription>WN12-CC-000066Microsoft Support Diagnostic Tool (MSDT) interactive communication with Microsoft must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents the MSDT from communicating with and sending collected data to Microsoft, the default support provider.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23633-1CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Troubleshooting and Diagnostics -> Microsoft Support Diagnostic Tool -> "Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -1870,7 +1862,7 @@ Registry Path: \Software\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\ Value Name: DisableQueryRemoteServer Type: REG_DWORD -Value: 0Windows Online Troubleshooting Service<GroupDescription></GroupDescription>WN12-CC-000067Access to Windows Online Troubleshooting Service (WOTS) must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 0Windows Online Troubleshooting Service<GroupDescription></GroupDescription>WN12-CC-000067Access to Windows Online Troubleshooting Service (WOTS) must be prevented.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents users from searching troubleshooting content on Microsoft servers. Only local content will be available.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24776-7CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Troubleshooting and Diagnostics -> Scripted Diagnostics -> "Troubleshooting: Allow users to access online troubleshooting content on Microsoft servers from the Troubleshooting Control Panel (via the Windows Online Troubleshooting Service - WOTS)" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -1879,7 +1871,7 @@ Registry Path: \Software\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\ Value Name: EnableQueryRemoteServer Type: REG_DWORD -Value: 0Disable PerfTrack<GroupDescription></GroupDescription>WN12-CC-000068Responsiveness events must be prevented from being aggregated and sent to Microsoft.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 0Disable PerfTrack<GroupDescription></GroupDescription>WN12-CC-000068Responsiveness events must be prevented from being aggregated and sent to Microsoft.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting prevents responsiveness events from being aggregated and sent to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25080-3CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Troubleshooting and Diagnostics -> Windows Performance PerfTrack -> "Enable/Disable PerfTrack" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -1888,7 +1880,7 @@ Registry Path: \Software\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781 Value Name: ScenarioExecutionEnabled Type: REG_DWORD -Value: 0Application Compatibility Program Inventory<GroupDescription></GroupDescription>WN12-CC-000071The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Value: 0Application Compatibility Program Inventory<GroupDescription></GroupDescription>WN12-CC-000071The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting will prevent the Program Inventory from collecting data about a system and sending the information to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25331-0CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Application Compatibility -> "Turn off Inventory Collector" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -1956,17 +1948,17 @@ Administrators - Full Control Users - Read ALL APPLICATION PACKAGES - ReadRestrict Anonymous SAM Enumeration<GroupDescription></GroupDescription>WN12-SO-000051Anonymous enumeration of SAM accounts must not be allowed.<VulnDiscussion>Anonymous enumeration of SAM accounts allows anonymous log on users (null session connections) to list all accounts names, thus providing a list of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23082-1CCI-000366Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Network access: Do not allow anonymous enumeration of SAM accounts" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymousSAM Value Type: REG_DWORD -Value: 1Legal Banner Dialog Box Title<GroupDescription></GroupDescription>WN12-SO-000023The Windows dialog box title for the legal banner must be configured.<VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24020-0CCI-000048CCI-001384CCI-001385CCI-001386CCI-001387CCI-001388Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive Logon: Message title for users attempting to log on" to "DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or a site-defined equivalent. +Value: 1Legal Banner Dialog Box Title<GroupDescription></GroupDescription>WN12-SO-000023The Windows dialog box title for the legal banner must be configured.<VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24020-0CCI-000048CCI-001384CCI-001385CCI-001386CCI-001387CCI-001388Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive Logon: Message title for users attempting to log on" to "DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or a site-defined equivalent. If a site-defined title is used, it can in no case contravene or modify the language of the banner text required in V-1089.If the following registry value does not exist or is not configured as specified, this is a finding: -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: LegalNoticeCaption @@ -1974,7 +1966,7 @@ Value Name: LegalNoticeCaption Value Type: REG_SZ Value: See message title options below -"DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or a site-defined equivalent. +"DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or a site-defined equivalent. If a site-defined title is used, it can in no case contravene or modify the language of the banner text required in V-1089. @@ -2032,9 +2024,9 @@ The application account must meet requirements for application account passwords Accounts with the "Allow log on through Remote Desktop Services" user right can access a system through Remote Desktop.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24406-1CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Allow log on through Remote Desktop Services" to only include the following accounts or groups: -Administrators +Administrators -If the system serves the Remote Desktop Services role, the Remote Desktop Users group or another more restrictive group may be included. +If the system serves the Remote Desktop Services role, the Remote Desktop Users group or another more restrictive group may be included. Organizations may grant this to other groups, such as more restrictive groups with administrative or management functions, if required. Remote Desktop Services access must be restricted to the accounts that require it. This must be documented with the ISSO.Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -2045,7 +2037,7 @@ If any accounts or groups other than the following are granted the "Allow log on Administrators -If the system serves the Remote Desktop Services role, the Remote Desktop Users group or another more restrictive group may be included. +If the system serves the Remote Desktop Services role, the Remote Desktop Users group or another more restrictive group may be included. Organizations may grant this to other groups, such as more restrictive groups with administrative or management functions, if required. Remote Desktop Services access must be restricted to the accounts that require it. This must be documented with the ISSO.Back up files and directories<GroupDescription></GroupDescription>WN12-UR-000007The Back up files and directories user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. @@ -2147,7 +2139,7 @@ Administrators Systems that have the Hyper-V role will also have "Virtual Machines" given this user right (this may be displayed as "NT Virtual Machine\Virtual Machines"). This is not a finding.Deny log on as a batch job<GroupDescription></GroupDescription>WN12-UR-000018-MSThe Deny log on as a batch job user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems, and from unauthenticated access on all systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -The "Deny log on as a batch job" user right defines accounts that are prevented from logging on to the system as a batch job such, as Task Scheduler. +The "Deny log on as a batch job" user right defines accounts that are prevented from logging on to the system as a batch job such, as Task Scheduler. In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain. @@ -2172,7 +2164,7 @@ Domain Admins Group All Systems: Guests GroupDeny log on as service <GroupDescription></GroupDescription>WN12-UR-000019-MSThe Deny log on as a service user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems. No other groups or accounts must be assigned this right.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -The "Deny log on as a service" user right defines accounts that are denied log on as a service. +The "Deny log on as a service" user right defines accounts that are denied log on as a service. In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain. @@ -2193,7 +2185,7 @@ Domain Admins Group If any accounts or groups are defined for the "Deny log on as a service" user right on non-domain-joined systems, this is a finding.Deny log on locally<GroupDescription></GroupDescription>WN12-UR-000020-MSThe Deny log on locally user right on member servers must be configured to prevent access from highly privileged domain accounts on domain systems, and from unauthenticated access on all systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -The "Deny log on locally" user right defines accounts that are prevented from logging on interactively. +The "Deny log on locally" user right defines accounts that are prevented from logging on interactively. In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain. @@ -2235,7 +2227,7 @@ Local account (see Note below) All Systems: Guests group -Note: Windows Server 2012 R2 added new built-in security groups, including "Local account", for assigning permissions and rights to all local accounts. +Note: Windows Server 2012 R2 added new built-in security groups, including "Local account", for assigning permissions and rights to all local accounts. Microsoft Security Advisory Patch 2871997 adds the new security groups to Windows Server 2012.Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -2252,7 +2244,7 @@ Local account (see Note below) All Systems: Guests group -Note: Windows Server 2012 R2 added new built-in security groups, including "Local account", for assigning permissions and rights to all local accounts. +Note: Windows Server 2012 R2 added new built-in security groups, including "Local account", for assigning permissions and rights to all local accounts. Microsoft Security Advisory Patch 2871997 adds the new security groups to Windows Server 2012.Enable accounts to be trusted for delegation<GroupDescription></GroupDescription>WN12-UR-000022-MSUnauthorized accounts must not have the Enable computer and user accounts to be trusted for delegation user right on member servers.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Enable computer and user accounts to be trusted for delegation" user right allows the "Trusted for Delegation" setting to be changed. This could potentially allow unauthorized users to impersonate other users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25270-0CCI-002235Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Enable computer and user accounts to be trusted for delegation" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. @@ -2469,7 +2461,7 @@ The requirement must be documented with the ISSO. The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011).Audit - Credential Validation - Success<GroupDescription></GroupDescription>WN12-AU-000001The system must be configured to audit Account Logon - Credential Validation successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Credential validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Logon -> "Audit Credential Validation" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Credential validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Logon -> "Audit Credential Validation" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2479,7 +2471,7 @@ Compare the AuditPol settings with the following. If the system does not audit Account Logon -> Credential Validation - SuccessAudit - Credential Validation - Failure<GroupDescription></GroupDescription>WN12-AU-000002The system must be configured to audit Account Logon - Credential Validation failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Credential validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Logon -> "Audit Credential Validation" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Credential validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Logon -> "Audit Credential Validation" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2489,7 +2481,7 @@ Compare the AuditPol settings with the following. If the system does not audit Account Logon -> Credential Validation - FailureAudit - Other Account Management Events - Success<GroupDescription></GroupDescription>WN12-AU-000015The system must be configured to audit Account Management - Other Account Management Events successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Other Account Management Events records events such as the access of a password hash or the Password Policy Checking API being called.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit Other Account Management Events" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Other Account Management Events records events such as the access of a password hash or the Password Policy Checking API being called.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit Other Account Management Events" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2499,7 +2491,7 @@ Compare the AuditPol settings with the following. If the system does not audit Account Management -> Other Account Management Events - SuccessAudit - Security Group Management - Success<GroupDescription></GroupDescription>WN12-AU-000017The system must be configured to audit Account Management - Security Group Management successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Security Group Management records events such as creating, deleting, or changing security groups, including changes in group members.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit Security Group Management" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Security Group Management records events such as creating, deleting, or changing security groups, including changes in group members.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit Security Group Management" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2509,7 +2501,7 @@ Compare the AuditPol settings with the following. If the system does not audit Account Management -> Security Group Management - SuccessAudit - User Account Management - Success<GroupDescription></GroupDescription>WN12-AU-000019The system must be configured to audit Account Management - User Account Management successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit User Account Management" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit User Account Management" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2519,7 +2511,7 @@ Compare the AuditPol settings with the following. If the system does not audit Account Management -> User Account Management - SuccessAudit - User Account Management - Failure<GroupDescription></GroupDescription>WN12-AU-000020The system must be configured to audit Account Management - User Account Management failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit User Account Management" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Account Management -> "Audit User Account Management" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2529,7 +2521,7 @@ Compare the AuditPol settings with the following. If the system does not audit Account Management -> User Account Management - FailureAudit - Process Creation - Success<GroupDescription></GroupDescription>WN12-AU-000023The system must be configured to audit Detailed Tracking - Process Creation successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Process Creation records events related to the creation of a process and the source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Detailed Tracking -> "Audit Process Creation" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Process Creation records events related to the creation of a process and the source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Detailed Tracking -> "Audit Process Creation" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2539,7 +2531,7 @@ Compare the AuditPol settings with the following. If the system does not audit Detailed Tracking -> Process Creation - SuccessAudit - Logoff - Success<GroupDescription></GroupDescription>WN12-AU-000045The system must be configured to audit Logon/Logoff - Logoff successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Logoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000067CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Logoff" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Logoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000067CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Logoff" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2549,7 +2541,7 @@ Compare the AuditPol settings with the following. If the system does not audit Logon/Logoff -> Logoff - SuccessAudit - Logon - Success<GroupDescription></GroupDescription>WN12-AU-000047The system must be configured to audit Logon/Logoff - Logon successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000067CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Logon" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000067CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Logon" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2559,7 +2551,7 @@ Compare the AuditPol settings with the following. If the system does not audit Logon/Logoff -> Logon - SuccessAudit - Logon - Failure<GroupDescription></GroupDescription>WN12-AU-000048The system must be configured to audit Logon/Logoff - Logon failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000067CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Logon" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000067CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Logon" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2569,7 +2561,7 @@ Compare the AuditPol settings with the following. If the system does not audit Logon/Logoff -> Logon - FailureAudit - Special Logon - Success<GroupDescription></GroupDescription>WN12-AU-000053The system must be configured to audit Logon/Logoff - Special Logon successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Special Logon records special logons which have administrative privileges and can be used to elevate processes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Special Logon" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Special Logon records special logons which have administrative privileges and can be used to elevate processes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Logon/Logoff -> "Audit Special Logon" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2579,7 +2571,7 @@ Compare the AuditPol settings with the following. If the system does not audit Logon/Logoff -> Special Logon - SuccessAudit - Audit Policy Change - Success<GroupDescription></GroupDescription>WN12-AU-000085The system must be configured to audit Policy Change - Audit Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Audit Policy Change records events related to changes in audit policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Audit Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Audit Policy Change records events related to changes in audit policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Audit Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2589,7 +2581,7 @@ Compare the AuditPol settings with the following. If the system does not audit Policy Change -> Audit Policy Change - SuccessAudit - Audit Policy Change - Failure<GroupDescription></GroupDescription>WN12-AU-000086The system must be configured to audit Policy Change - Audit Policy Change failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Audit Policy Change records events related to changes in audit policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Audit Policy Change" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Audit Policy Change records events related to changes in audit policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Audit Policy Change" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2599,7 +2591,7 @@ Compare the AuditPol settings with the following. If the system does not audit Policy Change -> Audit Policy Change - FailureAudit - Authentication Policy Change - Success<GroupDescription></GroupDescription>WN12-AU-000087The system must be configured to audit Policy Change - Authentication Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Authentication Policy Change records events related to changes in authentication policy, including Kerberos policy and Trust changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Authentication Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Authentication Policy Change records events related to changes in authentication policy, including Kerberos policy and Trust changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Authentication Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2609,7 +2601,7 @@ Compare the AuditPol settings with the following. If the system does not audit Policy Change -> Authentication Policy Change - SuccessAudit - Sensitive Privilege Use - Success<GroupDescription></GroupDescription>WN12-AU-000101The system must be configured to audit Privilege Use - Sensitive Privilege Use successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Privilege Use -> "Audit Sensitive Privilege Use" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Privilege Use -> "Audit Sensitive Privilege Use" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2619,7 +2611,7 @@ Compare the AuditPol settings with the following. If the system does not audit Privilege Use -> Sensitive Privilege Use - SuccessAudit - Sensitive Privilege Use - Failure<GroupDescription></GroupDescription>WN12-AU-000102The system must be configured to audit Privilege Use - Sensitive Privilege Use failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Privilege Use -> "Audit Sensitive Privilege Use" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Privilege Use -> "Audit Sensitive Privilege Use" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2629,7 +2621,7 @@ Compare the AuditPol settings with the following. If the system does not audit Privilege Use -> Sensitive Privilege Use - FailureAudit - IPSec Driver - Success<GroupDescription></GroupDescription>WN12-AU-000103The system must be configured to audit System - IPsec Driver successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -IPsec Driver records events related to the IPSec Driver such as dropped packets.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit IPsec Driver" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +IPsec Driver records events related to the IPSec Driver such as dropped packets.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit IPsec Driver" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2639,7 +2631,7 @@ Compare the AuditPol settings with the following. If the system does not audit System -> IPsec Driver - SuccessAudit - IPSec Driver - Failure<GroupDescription></GroupDescription>WN12-AU-000104The system must be configured to audit System - IPsec Driver failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -IPsec Driver records events related to the IPsec Driver such as dropped packets.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit IPsec Driver" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +IPsec Driver records events related to the IPsec Driver such as dropped packets.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit IPsec Driver" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2649,7 +2641,7 @@ Compare the AuditPol settings with the following. If the system does not audit System -> IPsec Driver - FailureAudit - Security State Change - Success<GroupDescription></GroupDescription>WN12-AU-000107The system must be configured to audit System - Security State Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Security State Change records events related to changes in the security state, such as startup and shutdown of the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit Security State Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Security State Change records events related to changes in the security state, such as startup and shutdown of the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit Security State Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2659,7 +2651,7 @@ Compare the AuditPol settings with the following. If the system does not audit System -> Security State Change - SuccessAudit - Security System Extension - Success<GroupDescription></GroupDescription>WN12-AU-000109The system must be configured to audit System - Security System Extension successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Security System Extension records events related to extension code being loaded by the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit Security System Extension" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Security System Extension records events related to extension code being loaded by the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit Security System Extension" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2669,7 +2661,7 @@ Compare the AuditPol settings with the following. If the system does not audit System -> Security System Extension - SuccessAudit - System Integrity - Success<GroupDescription></GroupDescription>WN12-AU-000111The system must be configured to audit System - System Integrity successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -System Integrity records events related to violations of integrity to the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit System Integrity" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +System Integrity records events related to violations of integrity to the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit System Integrity" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2679,7 +2671,7 @@ Compare the AuditPol settings with the following. If the system does not audit System -> System Integrity - SuccessAudit - System Integrity - Failure<GroupDescription></GroupDescription>WN12-AU-000112The system must be configured to audit System - System Integrity failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -System Integrity records events related to violations of integrity to the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit System Integrity" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +System Integrity records events related to violations of integrity to the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172CCI-002234Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> System -> "Audit System Integrity" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -2695,7 +2687,7 @@ Registry Path: \Software\Policies\Microsoft\Windows\TCPIP\v6Transition\ Value Name: 6to4_State Type: REG_SZ -Value: DisabledIP-HTTPS State<GroupDescription></GroupDescription>WN12-CC-000008The IP-HTTPS IPv6 transition technology must be disabled.<VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25651-1CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> TCPIP Settings -> IPv6 Transition Technologies -> "Set IP-HTTPS State" to "Enabled: Disabled State". +Value: DisabledIP-HTTPS State<GroupDescription></GroupDescription>WN12-CC-000008The IP-HTTPS IPv6 transition technology must be disabled.<VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25651-1CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Network -> TCPIP Settings -> IPv6 Transition Technologies -> "Set IP-HTTPS State" to "Enabled: Disabled State". Note: "IPHTTPS URL:" must be entered in the policy even if set to Disabled State. Enter "about:blank".If the following registry value does not exist or is not configured as specified, this is a finding: @@ -2767,7 +2759,7 @@ Run "Services.msc". If the following is installed and not disabled, this is a finding: -Fax (fax)Microsoft FTP Service Disabled<GroupDescription></GroupDescription>WN12-SV-000101The Microsoft FTP service must not be installed unless required.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23863-4CCI-000382Remove or disable the "Microsoft FTP Service" (Service name: FTPSVC). +Fax (fax)Microsoft FTP Service Disabled<GroupDescription></GroupDescription>WN12-SV-000101The Microsoft FTP service must not be installed unless required.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23863-4CCI-000382Remove or disable the "Microsoft FTP Service" (Service name: FTPSVC). To remove the "FTP Server" role from a system: Start "Server Manager" @@ -2780,25 +2772,25 @@ Click "Next" and "Remove" as prompted.Peer Networking Identity Manager Service Disabled<GroupDescription></GroupDescription>WN12-SV-000103The Peer Networking Identity Manager service must be disabled if installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24910-2CCI-000381Remove or disable the Peer Networking Identity Manager (p2pimsvc) service.Verify the Peer Network Identity Manager (p2pimsvc) service is not installed or is disabled. +If the "Microsoft FTP Service" (Service name: FTPSVC) is installed and not disabled, this is a finding.Peer Networking Identity Manager Service Disabled<GroupDescription></GroupDescription>WN12-SV-000103The Peer Networking Identity Manager service must be disabled if installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24910-2CCI-000381Remove or disable the Peer Networking Identity Manager (p2pimsvc) service.Verify the Peer Network Identity Manager (p2pimsvc) service is not installed or is disabled. Run "Services.msc". If the following is installed and not disabled, this is a finding: -Peer Networking Identity Manager (p2pimsvc)Simple TCP/IP Services Disabled<GroupDescription></GroupDescription>WN12-SV-000104The Simple TCP/IP Services service must be disabled if installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23748-7CCI-000381Remove or disable the Simple TCP/IP Services (simptcp) service.Verify the Simple TCP/IP (simptcp) service is not installed or is disabled. +Peer Networking Identity Manager (p2pimsvc)Simple TCP/IP Services Disabled<GroupDescription></GroupDescription>WN12-SV-000104The Simple TCP/IP Services service must be disabled if installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23748-7CCI-000381Remove or disable the Simple TCP/IP Services (simptcp) service.Verify the Simple TCP/IP (simptcp) service is not installed or is disabled. Run "Services.msc". If the following is installed and not disabled, this is a finding: -Simple TCP/IP Services (simptcp)Telnet Service Disabled<GroupDescription></GroupDescription>WN12-SV-000105The Telnet service must be disabled if installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24474-9CCI-000382Remove or disable the Telnet (tlntsvr) service.Verify the Telnet (tlntsvr) service is not installed or is disabled. +Simple TCP/IP Services (simptcp)Telnet Service Disabled<GroupDescription></GroupDescription>WN12-SV-000105The Telnet service must be disabled if installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24474-9CCI-000382Remove or disable the Telnet (tlntsvr) service.Verify the Telnet (tlntsvr) service is not installed or is disabled. Run "Services.msc". If the following is installed and not disabled, this is a finding: -Telnet (tlntsvr)Device Install Software Request Error Report<GroupDescription></GroupDescription>WN12-CC-000023Windows must be prevented from sending an error report when a device driver requests additional software during installation.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. +Telnet (tlntsvr)Device Install Software Request Error Report<GroupDescription></GroupDescription>WN12-CC-000023Windows must be prevented from sending an error report when a device driver requests additional software during installation.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. This setting will prevent Windows from sending an error report to Microsoft when a device driver requests additional software during installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24685-0CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation -> "Prevent Windows from sending an error report when a device driver requests additional software during installation" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -2823,7 +2815,7 @@ Execute the following command: Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*DoD*" | FL Subject, Thumbprint, NotAfter -If the following certificate "Subject" and "Thumbprint" information is not displayed, this is finding. +If the following certificate "Subject" and "Thumbprint" information is not displayed, this is finding. If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. @@ -2899,7 +2891,7 @@ Execute the following command: Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter -If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. +If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. @@ -2952,7 +2944,7 @@ Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 Valid to: Saturday, January 22, 2022WINRG-000001 Active Setup\Installed Components Registry Permissions<GroupDescription></GroupDescription>WN12-RG-000002Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key.<VulnDiscussion>Permissions on the Active Setup\Installed Components registry key must only allow privileged accounts to add or change registry values. If standard user accounts have these permissions, there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-002235Maintain the default permissions of the following registry keys: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\ HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\ (64-bit systems only) - + Users - Read Administrators - Full Control SYSTEM - Full Control @@ -2976,12 +2968,12 @@ Registry Path: \Software\Policies\Microsoft\Windows\Installer\ Value Name: AlwaysInstallElevated Type: REG_DWORD -Value: 0Local admin accounts filtered token policy enabled on domain systems.<GroupDescription></GroupDescription>WN12-RG-000003-MSLocal administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.<VulnDiscussion>A compromised local administrator account can provide means for an attacker to move laterally between domain systems. +Value: 0Local admin accounts filtered token policy enabled on domain systems.<GroupDescription></GroupDescription>WN12-RG-000003-MSLocal administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain systems.<VulnDiscussion>A compromised local administrator account can provide means for an attacker to move laterally between domain systems. With User Account Control enabled, filtering the privileged token for local administrator accounts will prevent the elevated privileges of these accounts from being used over the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-001084Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Apply UAC restrictions to local accounts on network logons" to "Enabled". -This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the system is not a member of a domain, this is NA. -If the following registry value does not exist or is not configured as specified, this is a finding: +This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the system is not a member of a domain, this is NA. +If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ @@ -3003,7 +2995,7 @@ Implement technical measures where feasible such as removal of applications or u The organization must have a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. -Technical measures such as the removal of applications or application whitelisting must be used where feasible to prevent the use of applications that access the Internet. +Technical measures such as the removal of applications or application whitelisting must be used where feasible to prevent the use of applications that access the Internet. If accounts with administrative privileges are not prevented from using applications that access the Internet or with potential Internet sources, this is a finding.WINUC-000001<GroupDescription></GroupDescription>WN12-UC-000001A screen saver must be enabled on the system.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked when unattended. Enabling a password-protected screen saver to engage after a specified period of time helps protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24055-6CCI-000060Configure the policy value for User Configuration -> Administrative Templates -> Control Panel -> Personalization -> "Enable screen saver" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: @@ -3016,8 +3008,8 @@ Type: REG_SZ Value: 1 Applications requiring continuous, real-time screen display (e.g., network management products) require the following and must be documented with the ISSO: - --The logon session does not have administrator rights. + +-The logon session does not have administrator rights. -The display station (e.g., keyboard, monitor, etc.) is located in a controlled access area.WINUC-000003<GroupDescription></GroupDescription>WN12-UC-000003The screen saver must be password protected.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked when unattended. Enabling a password-protected screen saver to engage after a specified period of time helps protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>PESL-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24680-1CCI-000056Configure the policy value for User Configuration -> Administrative Templates -> Control Panel -> Personalization -> "Password protect the screen saver" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER @@ -3026,7 +3018,7 @@ Registry Path: \Software\Policies\Microsoft\Windows\Control Panel\Desktop\ Value Name: ScreenSaverIsSecure Type: REG_SZ -Value: 1WIN00-000005-01<GroupDescription></GroupDescription>WN12-00-000004Users with administrative privilege must be documented.<VulnDiscussion>Administrative accounts may perform any action on a system. Users with administrative accounts must be documented to ensure those with this level of access are clearly identified.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Create the necessary documentation that identifies the members of the Administrators group.Review the necessary documentation that identifies the members of the Administrators group. If a list of all users belonging to the Administrators group is not maintained with the ISSO, this is a finding.WIN00-000005-02<GroupDescription></GroupDescription>WN12-00-000005Users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks.<VulnDiscussion>Using a privileged account to perform routine functions makes the computer vulnerable to malicious software inadvertently introduced during a session that has been granted full privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLP-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Ensure each user with administrative privileges has a separate account for user duties and one for privileged duties.Verify each user with administrative privileges has been assigned a unique administrative account separate from their standard user account. +Value: 1WIN00-000005-01<GroupDescription></GroupDescription>WN12-00-000004Users with administrative privilege must be documented.<VulnDiscussion>Administrative accounts may perform any action on a system. Users with administrative accounts must be documented to ensure those with this level of access are clearly identified.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Create the necessary documentation that identifies the members of the Administrators group.Review the necessary documentation that identifies the members of the Administrators group. If a list of all users belonging to the Administrators group is not maintained with the ISSO, this is a finding.WIN00-000005-02<GroupDescription></GroupDescription>WN12-00-000005Users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks.<VulnDiscussion>Using a privileged account to perform routine functions makes the computer vulnerable to malicious software inadvertently introduced during a session that has been granted full privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLP-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Ensure each user with administrative privileges has a separate account for user duties and one for privileged duties.Verify each user with administrative privileges has been assigned a unique administrative account separate from their standard user account. If users with administrative privileges do not have separate accounts for administrative functions and standard user functions, this is a finding.WIN00-000010-01<GroupDescription></GroupDescription>WN12-00-000010Policy must require application account passwords be at least 15 characters in length.<VulnDiscussion>Application/service account passwords must be of sufficient length to prevent being easily cracked. Application/service accounts that are manually managed must have passwords at least 15 characters in length.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IAIA-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000205Establish a site policy that requires application/service account passwords that are manually managed to be at least 15 characters in length. Ensure the policy is enforced.Verify the site has a policy to ensure passwords for manually managed application/service accounts are at least 15 characters in length. If such a policy does not exist or has not been implemented, this is a finding.WIN00-000010-02<GroupDescription></GroupDescription>WN12-00-000011Windows 2012/2012 R2 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.<VulnDiscussion>Setting application accounts to expire may cause applications to stop functioning. However, not changing them on a regular basis exposes them to attack. If managed service accounts are used, this alleviates the need to manually change application account passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Change passwords for manually managed application/service accounts at least annually or when an administrator with knowledge of the password leaves the organization. @@ -3054,7 +3046,7 @@ Enter 'Net User [application account name] | Find /i "Password Last Set"', where If the "Password Last Set" date is more than one year old, this is a finding.WIN00-000014<GroupDescription></GroupDescription>WN12-00-000006Policy must require that system administrators (SAs) be trained for the operating systems used by systems under their control.<VulnDiscussion>If SAs are assigned to systems running operating systems for which they have no training, these systems are at additional risk of unintentional misconfiguration that may result in vulnerabilities or decreased availability of the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLP-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Establish site policy that requires SAs be trained for all operating systems running on systems under their control.Determine whether the site has a policy that requires SAs be trained for all operating systems running on systems under their control. If the site does not have a policy requiring SAs be trained for all operating systems under their control, this is a finding.WINAU-000016<GroupDescription></GroupDescription>WN12-AU-000082The system must be configured to audit Object Access - Removable Storage failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -3066,7 +3058,7 @@ Object Access >> Removable Storage - Failure Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.WINAU-000017<GroupDescription></GroupDescription>WN12-AU-000081The system must be configured to audit Object Access - Removable Storage successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -3108,7 +3100,7 @@ Registry Path: \System\CurrentControlSet\Policies\EarlyLaunch\ Value Name: DriverLoadPolicy Type: REG_DWORD -Value: 1WINCC-000030<GroupDescription></GroupDescription>WN12-CC-000030Access to the Windows Store must be turned off.<VulnDiscussion>Uncontrolled installation of applications can introduce various issues, including system instability, and allow access to sensitive information. Installation of applications must be controlled by the enterprise. Turning off access to the Windows Store will limit access to publicly available applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24981-3CCI-000366If the \Windows\WinStore directory exists, configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> "Turn off access to the Store" to "Enabled". +Value: 1WINCC-000030<GroupDescription></GroupDescription>WN12-CC-000030Access to the Windows Store must be turned off.<VulnDiscussion>Uncontrolled installation of applications can introduce various issues, including system instability, and allow access to sensitive information. Installation of applications must be controlled by the enterprise. Turning off access to the Windows Store will limit access to publicly available applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24981-3CCI-000366If the \Windows\WinStore directory exists, configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> "Turn off access to the Store" to "Enabled". Alternately, uninstall the "Desktop Experience" feature from Windows 2012. This is located under "User Interfaces and Infrastructure" in the "Add Roles and Features Wizard". The \Windows\WinStore directory may need to be manually deleted after this.The Windows Store is not installed by default. If the \Windows\WinStore directory does not exist, this is NA. @@ -3176,13 +3168,15 @@ Registry Path: \Software\Policies\Microsoft\Windows\CredUI\ Value Name: DisablePasswordReveal Type: REG_DWORD -Value: 1WINCC-000088<GroupDescription></GroupDescription>WN12-CC-000088Windows SmartScreen must be enabled on Windows 2012/2012 R2.<VulnDiscussion>Windows SmartScreen helps protect systems from programs downloaded from the Internet that may be malicious. Warning a user before running downloaded unknown software, at minimum, will help prevent potentially malicious programs from executing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23531-7CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Configure Windows SmartScreen" to "Enabled" with either "Give user a warning before running downloaded unknown software" or "Require approval from an administrator before running downloaded unknown software" selected. +Value: 1WINCC-000088<GroupDescription></GroupDescription>WN12-CC-000088Windows SmartScreen must be enabled on Windows 2012/2012 R2.<VulnDiscussion>Windows SmartScreen helps protect systems from programs downloaded from the Internet that may be malicious. Warning a user before running downloaded unknown software, at minimum, will help prevent potentially malicious programs from executing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23531-7CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Configure Windows SmartScreen" to "Enabled" with either "Give user a warning before running downloaded unknown software" or "Require approval from an administrator before running downloaded unknown software" selected. Microsoft has changed this setting several times in the Windows 10 administrative templates, which will affect group policies in a domain if later templates are used. v1607 of Windows 10 and Windows Server 2016 changed the setting to only Enabled or Disabled without additional selections. Enabled is effectively "Give user a warning…". -v1703 of Windows 10 or later administrative templates changed the policy name to "Configure Windows Defender SmartScreen", and the selectable options are "Warn" and "Warn and prevent bypass". When either of these are applied to a Windows 2012/2012 R2 system, it will configure the registry equivalent of "Give user a warning…").If the following registry value does not exist or is not configured as specified, this is a finding: +v1703 of Windows 10 or later administrative templates changed the policy name to "Configure Windows Defender SmartScreen", and the selectable options are "Warn" and "Warn and prevent bypass". When either of these are applied to a Windows 2012/2012 R2 system, it will configure the registry equivalent of "Give user a warning…").This is applicable to unclassified systems; for other systems, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ @@ -3190,7 +3184,7 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ Value Name: EnableSmartScreen Type: REG_DWORD -Value: 0x00000001 (1) (Give user a warning…) +Value: 0x00000001 (1) (Give user a warning…) Or 0x00000002 (2) (Require approval…)WINCC-000095<GroupDescription></GroupDescription>WN12-CC-000095The location feature must be turned off.<VulnDiscussion>The location service on systems may allow sensitive data to be used by applications on the system. This should be turned off unless explicitly allowed for approved systems/applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-25343-5CCI-000381Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Location and Sensors -> "Turn off location" to "Enabled". If location services are approved by the organization for a device, this must be documented.If the following registry value does not exist or is not configured as specified, this is a finding: @@ -3216,7 +3210,7 @@ Value: 0WINCC- Windows 2012 R2: Windows 2012 R2 split the original policy that configures this setting into two separate ones. Configuring either one to "Enabled" will update the registry value as identified in the Check section. -Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Store -> +Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Store -> "Turn off Automatic Download of updates on Win8 machines" or "Turn off Automatic Download and install of updates" to "Enabled". Windows 2012: @@ -3346,13 +3340,15 @@ Administrators - Full Control The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder. -If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.</check-content></check></Rule></Group><Group id="V-36733"><title>WINGE-000027<GroupDescription></GroupDescription>WN12-00-000015User-level information must be backed up in accordance with local recovery time and recovery point objectives.<VulnDiscussion>Operating system backup is a critical step in maintaining data assurance and availability. +If the permissions for these files are not as restrictive as the ACLs listed, this is a finding.WINGE-000027<GroupDescription></GroupDescription>WN12-00-000015User-level information must be backed up in accordance with local recovery time and recovery point objectives.<VulnDiscussion>Operating system backup is a critical step in maintaining data assurance and availability. User-level information is data generated by information system and/or application users. -Backups shall be consistent with organizational recovery time and recovery point objectives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Implement user-level information backups in accordance with local recovery time and recovery point objectives.Determine whether user-level information is backed up in accordance with local recovery time and recovery point objectives. If user-level information is not backed up in accordance with local recovery time and recovery point objectives, this is a finding.WINGE-000028<GroupDescription></GroupDescription>WN12-GE-000023The operating system must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where HBSS is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).<VulnDiscussion>Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. The operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools..</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-001233Configure the operating system to employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where HBSS is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).Verify the operating system employs automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where HBSS is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP). If it does not, this is a finding.WINGE-000029<GroupDescription></GroupDescription>WN12-GE-000024The system must support automated patch management tools to facilitate flaw remediation.<VulnDiscussion>The organization (including any contractor to the organization) must promptly install security-relevant software updates (e.g., patches, service packs, hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Establish a process to automatically install security-related software updates.Verify the organization has an automated process to install security-related software updates. If it does not, this is a finding.WINGE-000030<GroupDescription></GroupDescription>WN12-GE-000025The system must query the certification authority to determine whether a public key certificate has been revoked before accepting the certificate for authentication purposes.<VulnDiscussion>Failure to verify a certificate's revocation status can result in the system accepting a revoked, and therefore unauthorized, certificate. This could result in the installation of unauthorized software or a connection for rogue networks, depending on the use for which the certificate is intended. Querying for certificate revocation mitigates the risk that the system will accept an unauthorized certificate.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Install software that provides certificate validation and revocation checking.Verify the system has software installed and running that provides certificate validation and revocation checking. If it does not, this is a finding.WINSO-000021<GroupDescription></GroupDescription>WN12-SO-000021The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and should be locked when unattended. The screen saver should be set at a maximum of 15 minutes and be password protected. This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23043-3CCI-000057Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive logon: Machine inactivity limit" to "900" seconds" or less, excluding "0" which is effectively disabled.If the following registry value does not exist or is not configured as specified, this is a finding: +Backups shall be consistent with organizational recovery time and recovery point objectives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Implement user-level information backups in accordance with local recovery time and recovery point objectives.Determine whether user-level information is backed up in accordance with local recovery time and recovery point objectives. If user-level information is not backed up in accordance with local recovery time and recovery point objectives, this is a finding.WINGE-000028<GroupDescription></GroupDescription>WN12-GE-000023Windows Server 2012 / 2012 R2 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where HBSS is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).<VulnDiscussion>Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. The operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools..</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-001233Install a DoD approved HBSS software and ensure it is operating continuously.Verify DoD approved HBSS software is installed, configured, and properly operating. Ask the operator to document the HBSS software installation and configuration. -Registry Hive: HKEY_LOCAL_MACHINE +If the operator is not able to provide a documented configuration for an installed HBSS or if the HBSS software is not properly configured, maintained, or used, this is a finding.WINGE-000029<GroupDescription></GroupDescription>WN12-GE-000024The system must support automated patch management tools to facilitate flaw remediation.<VulnDiscussion>The organization (including any contractor to the organization) must promptly install security-relevant software updates (e.g., patches, service packs, hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Establish a process to automatically install security-related software updates.Verify the organization has an automated process to install security-related software updates. If it does not, this is a finding.WINGE-000030<GroupDescription></GroupDescription>WN12-GE-000025The system must query the certification authority to determine whether a public key certificate has been revoked before accepting the certificate for authentication purposes.<VulnDiscussion>Failure to verify a certificate's revocation status can result in the system accepting a revoked, and therefore unauthorized, certificate. This could result in the installation of unauthorized software or a connection for rogue networks, depending on the use for which the certificate is intended. Querying for certificate revocation mitigates the risk that the system will accept an unauthorized certificate.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Install software that provides certificate validation and revocation checking.Verify the system has software installed and running that provides certificate validation and revocation checking. If it does not, this is a finding.WINSO-000021<GroupDescription></GroupDescription>WN12-SO-000021The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and should be locked when unattended. The screen saver should be set at a maximum of 15 minutes and be password protected. This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-23043-3CCI-000057Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive logon: Machine inactivity limit" to "900" seconds" or less, excluding "0" which is effectively disabled.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: InactivityTimeoutSecs @@ -3374,9 +3370,9 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotificat Value Name: NoToastApplicationNotificationOnLockScreen Type: REG_DWORD -Value: 1WN00-000016<GroupDescription></GroupDescription>WN12-00-000016Backups of system-level information must be protected.<VulnDiscussion>A system backup will usually include sensitive information such as user accounts that could be used in an attack. As a valuable system resource, the system backup must be protected and stored in a physically secure location.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>CODB-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Ensure system-level information backups are stored in a secure location and protected from destruction.Determine if system-level information backups are protected from destruction and stored in a physically secure location. If they are not, this is a finding.WN00-000017<GroupDescription></GroupDescription>WN12-00-000017System-related documentation must be backed up in accordance with local recovery time and recovery point objectives.<VulnDiscussion>Operating system backup is a critical step in maintaining data assurance and availability. +Value: 1WN00-000016<GroupDescription></GroupDescription>WN12-00-000016Backups of system-level information must be protected.<VulnDiscussion>A system backup will usually include sensitive information such as user accounts that could be used in an attack. As a valuable system resource, the system backup must be protected and stored in a physically secure location.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>CODB-2</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Ensure system-level information backups are stored in a secure location and protected from destruction.Determine if system-level information backups are protected from destruction and stored in a physically secure location. If they are not, this is a finding.WN00-000017<GroupDescription></GroupDescription>WN12-00-000017System-related documentation must be backed up in accordance with local recovery time and recovery point objectives.<VulnDiscussion>Operating system backup is a critical step in maintaining data assurance and availability. -Information system and security-related documentation contains information pertaining to system configuration and security settings. +Information system and security-related documentation contains information pertaining to system configuration and security settings. Backups shall be consistent with organizational recovery time and recovery point objectives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Back up system-related documentation in accordance with local recovery time and recovery point objectives.Determine whether system-related documentation is backed up in accordance with local recovery time and recovery point objectives. If system-related documentation is not backed up in accordance with local recovery time and recovery point objectives, this is a finding.WNGE-000007<GroupDescription></GroupDescription>WN12-GE-000007Permissions for program file directories must conform to minimum requirements.<VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. @@ -3430,7 +3426,7 @@ icacls "c:\program files (x86)" The following results should be displayed as each is entered: -c:\program files +c:\program files NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) @@ -3561,7 +3557,7 @@ Successfully processed 1 files; Failed processing 0 filesWNAU-000060<GroupDescription></GroupDescription>WN12-AU-000060The system must be configured to audit Object Access - Central Access Policy Staging failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Central Access Policy Staging auditing under Object Access is used to enable the recording of events related to differences in permissions between central access policies and proposed policies.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-2, ECAR-3</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> "Audit Central Access Policy Staging" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Central Access Policy Staging auditing under Object Access is used to enable the recording of events related to differences in permissions between central access policies and proposed policies.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-2, ECAR-3</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> "Audit Central Access Policy Staging" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -3571,7 +3567,7 @@ Compare the AuditPol settings with the following. If the system does not audit Object Access -> Central Policy Staging - FailureWNAU-000059<GroupDescription></GroupDescription>WN12-AU-000059The system must be configured to audit Object Access - Central Access Policy Staging successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Central Access Policy Staging auditing under Object Access is used to enable the recording of events related to differences in permissions between central access policies and proposed policies.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-2, ECAR-3</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> "Audit Central Access Policy Staging" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Central Access Policy Staging auditing under Object Access is used to enable the recording of events related to differences in permissions between central access policies and proposed policies.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-2, ECAR-3</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Object Access -> "Audit Central Access Policy Staging" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -3579,7 +3575,7 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Object Access -> Central Policy Staging - SuccessWNCC-000136<GroupDescription></GroupDescription>WN12-CC-000136Only the default client printer must be redirected to the Remote Desktop Session Host. (Remote Desktop Services Role).<VulnDiscussion>Allowing the redirection of only the default client printer to a Remote Desktop session helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24504-3CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Printer Redirection -> "Redirect only the default client printer" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: +Object Access -> Central Policy Staging - SuccessWNCC-000136<GroupDescription></GroupDescription>WN12-CC-000136Only the default client printer must be redirected to the Remote Desktop Session Host. (Remote Desktop Services Role).<VulnDiscussion>Allowing the redirection of only the default client printer to a Remote Desktop session helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24504-3CCI-000366Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Printer Redirection -> "Redirect only the default client printer" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ @@ -3587,7 +3583,7 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: RedirectOnlyDefaultClientPrinter Type: REG_DWORD -Value: 1WNSV-000106<GroupDescription></GroupDescription>WN12-SV-000106The Smart Card Removal Policy service must be configured to automatic.<VulnDiscussion>The automatic start of the Smart Card Removal Policy service is required to support the smart card removal behavior requirement.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24365-9CCI-000366Configure the Startup Type for the Smart Card Removal Policy service to "Automatic".Verify the Smart Card Removal Policy service is configured to "Automatic". +Value: 1WNSV-000106<GroupDescription></GroupDescription>WN12-SV-000106The Smart Card Removal Policy service must be configured to automatic.<VulnDiscussion>The automatic start of the Smart Card Removal Policy service is required to support the smart card removal behavior requirement.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCE-24365-9CCI-000366Configure the Startup Type for the Smart Card Removal Policy service to "Automatic".Verify the Smart Card Removal Policy service is configured to "Automatic". Run "Services.msc". @@ -3604,7 +3600,7 @@ Execute the following command: Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter -If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. +If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. @@ -3652,7 +3648,7 @@ Configure the policy value for Computer Configuration -> Administrative Templ Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Personalization\ Value Name: NoLockScreenSlideshow @@ -3664,7 +3660,7 @@ Enabling "Include command line data for process creation events" will record the Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ Value Name: ProcessCreationIncludeCmdLine_Enabled @@ -3676,7 +3672,7 @@ Configure the policy value for Computer Configuration -> Administrative Templ Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ Value Name: DontDisplayNetworkSelectionUI @@ -3688,7 +3684,7 @@ Configure the policy value for Computer Configuration -> Administrative Templ Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Value Name: MSAOptional @@ -3700,7 +3696,7 @@ Configure the policy value for Computer Configuration -> Administrative Templ Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. -Registry Hive: HKEY_LOCAL_MACHINE +Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: DisableAutomaticRestartSignOn @@ -3708,7 +3704,7 @@ Value Name: DisableAutomaticRestartSignOn Value Type: REG_DWORD Value: 1WINAU-000089<GroupDescription></GroupDescription>WN12-AU-000089The system must be configured to audit Policy Change - Authorization Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Authorization Policy Change records events related to changes in user rights, such as Create a token object.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Authorization Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. +Authorization Policy Change records events related to changes in user rights, such as Create a token object.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000172Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Policy Change -> "Audit Authorization Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: -Open a Command Prompt with elevated privileges ("Run as Administrator"). @@ -3927,7 +3923,7 @@ Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol Alternately: Search for "Features". Select "Turn Windows features on or off". -De-select "SMB 1.0/CIFS File Sharing Support". +De-select "SMB 1.0/CIFS File Sharing Support". The system must be restarted for the changes to take effect.This requirement applies to Windows 2012 R2, it is NA for Windows 2012 (see V-73519 and V-73523 for 2012 requirements). @@ -3961,7 +3957,7 @@ Open an elevated "Command Prompt" (run as administrator). Enter "AuditPol /get /category:*" -Compare the AuditPol settings with the following. +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. @@ -4001,7 +3997,7 @@ Open an elevated "Command Prompt" (run as administrator). Enter "AuditPol /get /category:*". -Compare the AuditPol settings with the following. +Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. @@ -4018,7 +4014,7 @@ WMF 5.0: https://docs.microsoft.com/en-us/powershell/wmf/5.0/productincompat WMF 5.1: -https://docs.microsoft.com/en-us/powershell/wmf/5.1/productincompat</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Update Windows PowerShell to version 4.0 or 5.x. +https://docs.microsoft.com/en-us/powershell/wmf/5.1/productincompat</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000366Update Windows PowerShell to version 4.0 or 5.x. Windows 2012 R2 includes PowerShell 4.0 by default. It may be updated with the installation of Windows Management Framework (WMF) 5.0 or 5.1. @@ -4039,35 +4035,35 @@ Enter "$PSVersionTable". If the value for "PSVersion" is not 4.0 or 5.x, this is a finding. -Windows 2012 R2 includes PowerShell 4.0 by default. Windows 2012 must be updated. If PowerShell 4.0 is used, the required patch for script block logging will be verified with the requirement to have that enabled.WIN00-000210<GroupDescription></GroupDescription>WN12-00-000210PowerShell script block logging must be enabled on Windows 2012/2012 R2.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. +Windows 2012 R2 includes PowerShell 4.0 by default. Windows 2012 must be updated. If PowerShell 4.0 is used, the required patch for script block logging will be verified with the requirement to have that enabled.WIN00-000210<GroupDescription></GroupDescription>WN12-00-000210PowerShell script block logging must be enabled on Windows 2012/2012 R2.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Enabling PowerShell script block logging will record detailed information from the processing of PowerShell commands and scripts. This can provide additional detail when malware has run on a system. -PowerShell 5.x supports script block logging. PowerShell 4.0 with the addition of patch KB3000850 on Windows 2012 R2 or KB3119938 on Windows 2012 adds support for script block logging.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000135Configure the following registry value as specified. +PowerShell 5.x supports script block logging. PowerShell 4.0 with the addition of patch KB3000850 on Windows 2012 R2 or KB3119938 on Windows 2012 adds support for script block logging.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2012DISADPMS TargetWindows 20122350CCI-000135Configure the following registry value as specified. -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ Value Name: EnableScriptBlockLogging Value Type: REG_DWORD Value: 0x00000001 (1) -Administrative templates from later versions of Windows include a group policy setting for this. Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> "Turn on PowerShell Script Block Logging" to "Enabled". +Administrative templates from later versions of Windows include a group policy setting for this. Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> "Turn on PowerShell Script Block Logging" to "Enabled". -Install patch KB3000850 on Windows 2012 R2 or KB3119938 on Windows 2012 on systems with PowerShell 4.0. +Install patch KB3000850 on Windows 2012 R2 or KB3119938 on Windows 2012 on systems with PowerShell 4.0. -PowerShell 5.x does not require the installation of an additional patch.If the following registry value does not exist or is not configured as specified, this is a finding. +PowerShell 5.x does not require the installation of an additional patch.If the following registry value does not exist or is not configured as specified, this is a finding. -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ Value Name: EnableScriptBlockLogging Value Type: REG_DWORD Value: 0x00000001 (1) -PowerShell 4.0 requires the installation of patch KB3000850 on Windows 2012 R2 or KB3119938 on Windows 2012. +PowerShell 4.0 requires the installation of patch KB3000850 on Windows 2012 R2 or KB3119938 on Windows 2012. If the patch is not installed on systems with PowerShell 4.0, this is a finding. diff --git a/StigData/Archive/Windows.Server.2012R2/U_Windows_2012_and_2012_R2_DC_STIG-xccdf.md b/StigData/Archive/Windows.Server.2012R2/U_Windows_2012_and_2012_R2_DC_STIG-xccdf.md deleted file mode 100644 index 31ed12d00..000000000 --- a/StigData/Archive/Windows.Server.2012R2/U_Windows_2012_and_2012_R2_DC_STIG-xccdf.md +++ /dev/null @@ -1,40 +0,0 @@ -# Windows Server 2012 R2 Domain Controller formatting updates - -xccdf files are formated to ease reading the raw content using the following VS Code extension - -https://marketplace.visualstudio.com/items?itemName=DotJoshJohnson.xml - -Updates are listed in the following format: - -RuleId::LineNumber(ZeroIndex)::Updated line - -## V2R15 - -* V-2377::8::If the value for "Maximum lifetime for service ticket" is "0" or greater than "600" minutes, this is a finding. -* V-2378::8::If the value for "Maximum lifetime for user ticket" is "0" or greater than "10" hours, this is a finding. -* V-2379::8::If the "Maximum lifetime for user ticket renewal" is greater than "7" days, this is a finding. -* V-2380::8::If the "Maximum tolerance for computer clock synchronization" is greater than "5" minutes, this is a finding. -* V-36707::8::Value: 1 (Give user a warning…) Or 2 (Require approval…) - -## V2R14 - -* V-2377::8::If the value for "Maximum lifetime for service ticket" is "0" or greater than "600" minutes, this is a finding. -* V-2378::8::If the value for "Maximum lifetime for user ticket" is "0" or greater than "10" hours, this is a finding. -* V-2379::8::If the "Maximum lifetime for user ticket renewal" is greater than "7" days, this is a finding. -* V-2380::8::If the "Maximum tolerance for computer clock synchronization" is greater than "5" minutes, this is a finding. -* V-36707::8::Value: 1 (Give user a warning…) Or 2 (Require approval…) - -## V2R13 - -* V-2377::8::If the value for "Maximum lifetime for service ticket" is "0" or greater than "600" minutes, this is a finding. -* V-2378::8::If the value for "Maximum lifetime for user ticket" is "0" or greater than "10" hours, this is a finding. -* V-2379::8::If the "Maximum lifetime for user ticket renewal" is greater than "7" days, this is a finding. -* V-2380::8::If the "Maximum tolerance for computer clock synchronization" is greater than "5" minutes, this is a finding. -* V-36707::8::Value: 1 (Give user a warning…) Or 2 (Require approval…) - -## V2R12 - -* V-2377::8::If the value for "Maximum lifetime for service ticket" is "0" or greater than "600" minutes, this is a finding. -* V-2378::8::If the value for "Maximum lifetime for user ticket" is "0" or greater than "10" hours, this is a finding. -* V-2379::8::If the "Maximum lifetime for user ticket renewal" is greater than "7" days, this is a finding. -* V-2380::8::If the "Maximum tolerance for computer clock synchronization" is greater than "5" minutes, this is a finding. diff --git a/StigData/Archive/Windows.Server.2012R2/U_Windows_2012_and_2012_R2_MS_STIG-xccdf.md b/StigData/Archive/Windows.Server.2012R2/U_Windows_2012_and_2012_R2_MS_STIG-xccdf.md deleted file mode 100644 index 794e50eae..000000000 --- a/StigData/Archive/Windows.Server.2012R2/U_Windows_2012_and_2012_R2_MS_STIG-xccdf.md +++ /dev/null @@ -1,23 +0,0 @@ -# Windows Server 2012 R2 Member Server formatting updates - -xccdf files are formated to ease reading the raw content using the following VS Code extension - -https://marketplace.visualstudio.com/items?itemName=DotJoshJohnson.xml - -Updates are listed in the following format: - -RuleId::LineNumber(ZeroIndex)::Updated line - -Example: - -V-2377::8::If the value for "Maximum lifetime for service ticket" is "0" or greater than "600" minutes, this is a finding. - -## V2R14 - -* V-36707::8::Value: 1 (Give user a warning…) Or 2 (Require approval…) - -## V2R13 - -* V-36707::8::Value: 1 (Give user a warning…) Or 2 (Require approval…) - -## V2R12 diff --git a/StigData/Processed/WindowsServer-2012R2-DC-2.16.org.default.xml b/StigData/Processed/WindowsServer-2012R2-DC-2.18.org.default.xml similarity index 99% rename from StigData/Processed/WindowsServer-2012R2-DC-2.16.org.default.xml rename to StigData/Processed/WindowsServer-2012R2-DC-2.18.org.default.xml index c1611e7f5..c9628464b 100644 --- a/StigData/Processed/WindowsServer-2012R2-DC-2.16.org.default.xml +++ b/StigData/Processed/WindowsServer-2012R2-DC-2.18.org.default.xml @@ -5,7 +5,7 @@ Each setting in this file is linked by STIG ID and the valid range is in an associated comment. --> - + diff --git a/StigData/Processed/WindowsServer-2012R2-DC-2.16.xml b/StigData/Processed/WindowsServer-2012R2-DC-2.18.xml similarity index 99% rename from StigData/Processed/WindowsServer-2012R2-DC-2.16.xml rename to StigData/Processed/WindowsServer-2012R2-DC-2.18.xml index dab31237b..40146167b 100644 --- a/StigData/Processed/WindowsServer-2012R2-DC-2.16.xml +++ b/StigData/Processed/WindowsServer-2012R2-DC-2.18.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -1216,6 +1216,28 @@ Password: "Password" ftp> "Dir" If the FTP session indicates access to areas of the system other than the specific folder for FTP data, such as the root of the drive, Program Files or Windows directories, this is a finding. + + + <VulnDiscussion>Windows shares are a means by which files, folders, printers, and other resources can be published for network users to access. Improper configuration can permit access to devices and data beyond a user's need.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Open "Devices and Printers" in Control Panel or through Search. +If there are no printers configured, this is NA. (Exclude Microsoft Print to PDF and Microsoft XPS Document Writer, which do not support sharing.) + +For each configured printer: +Right click on the printer. +Select "Printer Properties". +Select the "Sharing" tab. +View whether "Share this printer" is checked. + +For any printers with "Share this printer" selected: +Select the Security tab. + +If any standard user accounts or groups have permissions other than "Print", this is a finding. +Standard users will typically be given "Print" permission through the Everyone group. +"All APPLICATION PACKAGES" and "CREATOR OWNER" are not considered standard user accounts for this requirement. <VulnDiscussion>Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Visibility of members of the Backup Operators group must be maintained.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -1410,7 +1432,7 @@ If the classification level of the Windows domain controller is higher than the If any files with these extensions exist, this is a finding. -This does not apply to server-based applications that have a requirement for certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO. +This does not apply to server-based applications that have a requirement for certificate files or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO. <VulnDiscussion>A PKI implementation depends on the practices established by the Certificate Authority (CA) to ensure the implementation is secure. Without proper practices, the certificates issued by a CA have limited value in authentication functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -1574,6 +1596,16 @@ The Anonymous Logon, Guests, or any group that contains those groups (in which u Review the necessary documentation that identifies the members of the Administrators group. If a list of all users belonging to the Administrators group is not maintained with the ISSO, this is a finding. + + <VulnDiscussion>Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. The operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools..</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify DoD approved HBSS software is installed, configured, and properly operating. Ask the operator to document the HBSS software installation and configuration. + +If the operator is not able to provide a documented configuration for an installed HBSS or if the HBSS software is not properly configured, maintained, or used, this is a finding. + <VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. @@ -1720,28 +1752,6 @@ The built-in Administrator account or other required administrative accounts wou Security configuration tools that are integrated into Windows, such as Group Policies and Security Templates, may be used to configure platforms for security compliance. If an alternate method is used to configure a system (e.g., manually using the DISA Windows Security STIGs, etc.) and the same configured result is achieved, this is acceptable. - - - <VulnDiscussion>Windows shares are a means by which files, folders, printers, and other resources can be published for network users to access. Improper configuration can permit access to devices and data beyond a user's need.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Open "Devices and Printers" in Control Panel or through Search. -If there are no printers configured, this is NA. - -For each configured printer: -Right click on the printer. -Select "Printer Properties". -Select the "Sharing" tab. -View whether "Share this printer" is checked. - -For any printers with "Share this printer" selected: -Select the Security tab. - -If any standard user accounts or groups have permissions other than "Print", this is a finding. -Standard users will typically be given "Print" permission through the Everyone group. -"All APPLICATION PACKAGES" and "CREATOR OWNER" are not considered standard user accounts for this requirement. <VulnDiscussion>Monitoring system files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>DCSL-1</IAControls> @@ -1834,7 +1844,7 @@ Domain Controllers: Enter "Get-ADUser -Filter * -Properties PasswordNotRequired | Where PasswordNotRequired -eq True | FT Name, PasswordNotRequired, Enabled". -Exclude disabled accounts (e.g., Guest). +Exclude disabled accounts (e.g., Guest) and Trusted Domain Objects (TDOs). If "PasswordNotRequired" is "True" for any enabled user account, this is a finding. @@ -2270,14 +2280,6 @@ Backups shall be consistent with organizational recovery time and recovery point Determine whether user-level information is backed up in accordance with local recovery time and recovery point objectives. If user-level information is not backed up in accordance with local recovery time and recovery point objectives, this is a finding. - - <VulnDiscussion>Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. The operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools..</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Verify the operating system employs automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where HBSS is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP). If it does not, this is a finding. - <VulnDiscussion>The organization (including any contractor to the organization) must promptly install security-relevant software updates (e.g., patches, service packs, hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -3680,7 +3682,7 @@ Viewing in File Explorer: For each folder, view the Properties. Select the "Security" tab, and the "Advanced" button. Default Permissions: -\Program Files +\Program Files Type - "Allow" for all Inherited from - "None" for all Principal - Access - Applies to @@ -4640,27 +4642,6 @@ This setting may prevent a system from being joined to a domain if not configure RequireStrongKey Dword - - <VulnDiscussion>This setting controls the storage of passwords and credentials for network authentication on the local system. Such credentials must not be stored on the local machine, as that may lead to account compromise.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa - False - - If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Lsa\ - -Value Name: DisableDomainCreds - -Value Type: REG_DWORD -Value: 1 - 1 - DisableDomainCreds - Dword - <VulnDiscussion>Access by anonymous users must be restricted. If this setting is enabled, then anonymous users have the same rights and permissions as the built-in Everyone group. Anonymous users must not have these permissions or rights.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -7867,7 +7848,9 @@ Value: 1 HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System True '{0}' -match '1|2' - If the following registry value does not exist or is not configured as specified, this is a finding: + This is applicable to unclassified systems; for other systems, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ @@ -7875,7 +7858,7 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ Value Name: EnableSmartScreen Type: REG_DWORD -Value: 0x00000001 (1) (Give user a warning…) +Value: 0x00000001 (1) (Give user a warning…) Or 0x00000002 (2) (Require approval…) EnableSmartScreen diff --git a/StigData/Processed/WindowsServer-2012R2-MS-2.15.org.default.xml b/StigData/Processed/WindowsServer-2012R2-MS-2.17.org.default.xml similarity index 97% rename from StigData/Processed/WindowsServer-2012R2-MS-2.15.org.default.xml rename to StigData/Processed/WindowsServer-2012R2-MS-2.17.org.default.xml index 5309af3d8..10c0f0030 100644 --- a/StigData/Processed/WindowsServer-2012R2-MS-2.15.org.default.xml +++ b/StigData/Processed/WindowsServer-2012R2-MS-2.17.org.default.xml @@ -1,71 +1,71 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/StigData/Processed/WindowsServer-2012R2-MS-2.15.xml b/StigData/Processed/WindowsServer-2012R2-MS-2.17.xml similarity index 98% rename from StigData/Processed/WindowsServer-2012R2-MS-2.15.xml rename to StigData/Processed/WindowsServer-2012R2-MS-2.17.xml index 02676eee6..137ec4ddc 100644 --- a/StigData/Processed/WindowsServer-2012R2-MS-2.15.xml +++ b/StigData/Processed/WindowsServer-2012R2-MS-2.17.xml @@ -1,43 +1,43 @@ - - - - <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - True - '{0}' -le '3' -and '{0}' -ne '0' - Account lockout threshold - + + + + <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -le '3' -and '{0}' -ne '0' + Account lockout threshold + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Account Lockout Policy. -If the "Account lockout threshold" is "0" or more than "3" attempts, this is a finding. - - - <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to "0". The smaller this value is, the less effective the account lockout feature will be in protecting the local system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - True - '{0}' -ge '15' - Reset account lockout counter after - +If the "Account lockout threshold" is "0" or more than "3" attempts, this is a finding. + + + <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to "0". The smaller this value is, the less effective the account lockout feature will be in protecting the local system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -ge '15' + Reset account lockout counter after + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. -If the "Reset account lockout counter after" value is less than "15" minutes, this is a finding. - - - <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that an account will remain locked after the specified number of failed logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - True - '{0}' -ge '15' -or '{0}' -eq '0' - Account lockout duration - +If the "Reset account lockout counter after" value is less than "15" minutes, this is a finding. + + + <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that an account will remain locked after the specified number of failed logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -ge '15' -or '{0}' -eq '0' + Account lockout duration + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -45,61 +45,61 @@ Navigate to Local Computer Policy >> Computer Configuration >> Windo If the "Account lockout duration" is less than "15" minutes (excluding "0"), this is a finding. -Configuring this to "0", requiring an administrator to unlock the account, is more restrictive and is not a finding. - - - <VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - True - '{0}' -le '60' -and '{0}' -ne '0' - Maximum password age - +Configuring this to "0", requiring an administrator to unlock the account, is more restrictive and is not a finding. + + + <VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -le '60' -and '{0}' -ne '0' + Maximum password age + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy. -If the value for the "Maximum password age" is greater than "60" days, this is a finding. If the value is set to "0" (never expires), this is a finding. - - - <VulnDiscussion>Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database. This enables users to effectively negate the purpose of mandating periodic password changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - True - '{0}' -ne '0' - Minimum password age - +If the value for the "Maximum password age" is greater than "60" days, this is a finding. If the value is set to "0" (never expires), this is a finding. + + + <VulnDiscussion>Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database. This enables users to effectively negate the purpose of mandating periodic password changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -ne '0' + Minimum password age + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy. -If the value for the "Minimum password age" is set to "0" days ("Password can be changed immediately."), this is a finding. - - - <VulnDiscussion>A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change to a unique password on a regularly scheduled basis. This enables users to effectively negate the purpose of mandating periodic password changes. The default value is 24 for Windows domain systems. DoD has decided this is the appropriate value for all Windows systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - True - '{0}' -ge '24' - Enforce password history - +If the value for the "Minimum password age" is set to "0" days ("Password can be changed immediately."), this is a finding. + + + <VulnDiscussion>A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change to a unique password on a regularly scheduled basis. This enables users to effectively negate the purpose of mandating periodic password changes. The default value is 24 for Windows domain systems. DoD has decided this is the appropriate value for all Windows systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -ge '24' + Enforce password history + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. -If the value for "Enforce password history" is less than "24" passwords remembered, this is a finding. - - - <VulnDiscussion>The use of complex passwords increases their strength against attack. The built-in Windows password complexity policy requires passwords to contain at least 3 of the 4 types of characters (numbers, upper- and lower-case letters, and special characters), as well as preventing the inclusion of user names or parts of.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Password must meet complexity requirements - Enabled +If the value for "Enforce password history" is less than "24" passwords remembered, this is a finding. + + + <VulnDiscussion>The use of complex passwords increases their strength against attack. The built-in Windows password complexity policy requires passwords to contain at least 3 of the 4 types of characters (numbers, upper- and lower-case letters, and special characters), as well as preventing the inclusion of user names or parts of.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Password must meet complexity requirements + Enabled Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -107,50 +107,50 @@ Navigate to Local Computer Policy >> Computer Configuration >> Windo If the value for "Password must meet complexity requirements" is not set to "Enabled", this is a finding. -Note: If an external password filter is in use that enforces all 4 character types and requires this setting be set to "Disabled", this would not be considered a finding. If this setting does not affect the use of an external password filter, it must be enabled for fallback purposes. - - - <VulnDiscussion>Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords. For this reason, this policy must never be enabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Store passwords using reversible encryption - Disabled +Note: If an external password filter is in use that enforces all 4 character types and requires this setting be set to "Disabled", this would not be considered a finding. If this setting does not affect the use of an external password filter, it must be enabled for fallback purposes. + + + <VulnDiscussion>Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords. For this reason, this policy must never be enabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Store passwords using reversible encryption + Disabled Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy. -If the value for "Store password using reversible encryption" is not set to "Disabled", this is a finding. - - - <VulnDiscussion>Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system and compromising the device, information, or the local network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - True - '{0}' -ge '14' - Minimum password length - +If the value for "Store password using reversible encryption" is not set to "Disabled", this is a finding. + + + <VulnDiscussion>Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system and compromising the device, information, or the local network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -ge '14' + Minimum password length + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy. -If the value for the "Minimum password length," is less than "14" characters, this is a finding. - - - - - Success +If the value for the "Minimum password length," is less than "14" characters, this is a finding. + + + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Credential validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Credential validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -159,19 +159,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Account Logon -> Credential Validation - Success - Credential Validation - - - Failure +Account Logon -> Credential Validation - Success + Credential Validation + + + Failure <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Credential validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Credential validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -180,19 +180,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Account Logon -> Credential Validation - Failure - Credential Validation - - - Success +Account Logon -> Credential Validation - Failure + Credential Validation + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Other Account Management Events records events such as the access of a password hash or the Password Policy Checking API being called.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Other Account Management Events records events such as the access of a password hash or the Password Policy Checking API being called.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -201,19 +201,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Account Management -> Other Account Management Events - Success - Other Account Management Events - - - Success +Account Management -> Other Account Management Events - Success + Other Account Management Events + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Security Group Management records events such as creating, deleting, or changing security groups, including changes in group members.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Security Group Management records events such as creating, deleting, or changing security groups, including changes in group members.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -222,19 +222,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Account Management -> Security Group Management - Success - Security Group Management - - - Success +Account Management -> Security Group Management - Success + Security Group Management + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -243,19 +243,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Account Management -> User Account Management - Success - User Account Management - - - Failure +Account Management -> User Account Management - Success + User Account Management + + + Failure <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -264,19 +264,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Account Management -> User Account Management - Failure - User Account Management - - - Success +Account Management -> User Account Management - Failure + User Account Management + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Process Creation records events related to the creation of a process and the source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Process Creation records events related to the creation of a process and the source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -285,19 +285,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Detailed Tracking -> Process Creation - Success - Process Creation - - - Success +Detailed Tracking -> Process Creation - Success + Process Creation + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Logoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Logoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -306,19 +306,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Logon/Logoff -> Logoff - Success - Logoff - - - Success +Logon/Logoff -> Logoff - Success + Logoff + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -327,19 +327,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Logon/Logoff -> Logon - Success - Logon - - - Failure +Logon/Logoff -> Logon - Success + Logon + + + Failure <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -348,19 +348,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Logon/Logoff -> Logon - Failure - Logon - - - Success +Logon/Logoff -> Logon - Failure + Logon + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Special Logon records special logons which have administrative privileges and can be used to elevate processes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Special Logon records special logons which have administrative privileges and can be used to elevate processes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -369,19 +369,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Logon/Logoff -> Special Logon - Success - Special Logon - - - Success +Logon/Logoff -> Special Logon - Success + Special Logon + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Audit Policy Change records events related to changes in audit policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Audit Policy Change records events related to changes in audit policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -390,19 +390,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Policy Change -> Audit Policy Change - Success - Audit Policy Change - - - Failure +Policy Change -> Audit Policy Change - Success + Audit Policy Change + + + Failure <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Audit Policy Change records events related to changes in audit policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Audit Policy Change records events related to changes in audit policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -411,19 +411,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Policy Change -> Audit Policy Change - Failure - Audit Policy Change - - - Success +Policy Change -> Audit Policy Change - Failure + Audit Policy Change + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Authentication Policy Change records events related to changes in authentication policy, including Kerberos policy and Trust changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Authentication Policy Change records events related to changes in authentication policy, including Kerberos policy and Trust changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -432,19 +432,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Policy Change -> Authentication Policy Change - Success - Authentication Policy Change - - - Success +Policy Change -> Authentication Policy Change - Success + Authentication Policy Change + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -453,19 +453,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Privilege Use -> Sensitive Privilege Use - Success - Sensitive Privilege Use - - - Failure +Privilege Use -> Sensitive Privilege Use - Success + Sensitive Privilege Use + + + Failure <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs".</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -474,19 +474,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Privilege Use -> Sensitive Privilege Use - Failure - Sensitive Privilege Use - - - Success +Privilege Use -> Sensitive Privilege Use - Failure + Sensitive Privilege Use + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -IPsec Driver records events related to the IPSec Driver such as dropped packets.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +IPsec Driver records events related to the IPSec Driver such as dropped packets.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -495,19 +495,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -System -> IPsec Driver - Success - IPsec Driver - - - Failure +System -> IPsec Driver - Success + IPsec Driver + + + Failure <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -IPsec Driver records events related to the IPsec Driver such as dropped packets.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +IPsec Driver records events related to the IPsec Driver such as dropped packets.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -516,19 +516,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -System -> IPsec Driver - Failure - IPsec Driver - - - Success +System -> IPsec Driver - Failure + IPsec Driver + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Security State Change records events related to changes in the security state, such as startup and shutdown of the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Security State Change records events related to changes in the security state, such as startup and shutdown of the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -537,19 +537,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -System -> Security State Change - Success - Security State Change - - - Success +System -> Security State Change - Success + Security State Change + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Security System Extension records events related to extension code being loaded by the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Security System Extension records events related to extension code being loaded by the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -558,19 +558,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -System -> Security System Extension - Success - Security System Extension - - - Success +System -> Security System Extension - Success + Security System Extension + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -System Integrity records events related to violations of integrity to the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +System Integrity records events related to violations of integrity to the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -579,19 +579,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -System -> System Integrity - Success - System Integrity - - - Failure +System -> System Integrity - Success + System Integrity + + + Failure <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -System Integrity records events related to violations of integrity to the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +System Integrity records events related to violations of integrity to the security subsystem.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -600,19 +600,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -System -> System Integrity - Failure - System Integrity - - - Failure +System -> System Integrity - Failure + System Integrity + + + Failure <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -623,19 +623,19 @@ Compare the AuditPol settings with the following. If the system does not audit Object Access >> Removable Storage - Failure -Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding. - Removable Storage - - - Success +Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding. + Removable Storage + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -646,19 +646,19 @@ Compare the AuditPol settings with the following. If the system does not audit Object Access >> Removable Storage - Success -Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding. - Removable Storage - - - Failure +Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding. + Removable Storage + + + Failure <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Central Access Policy Staging auditing under Object Access is used to enable the recording of events related to differences in permissions between central access policies and proposed policies.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-2, ECAR-3</IAControls> - - Present - False - False - +Central Access Policy Staging auditing under Object Access is used to enable the recording of events related to differences in permissions between central access policies and proposed policies.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-2, ECAR-3</IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -667,19 +667,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Object Access -> Central Policy Staging - Failure - Central Policy Staging - - - Success +Object Access -> Central Policy Staging - Failure + Central Policy Staging + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Central Access Policy Staging auditing under Object Access is used to enable the recording of events related to differences in permissions between central access policies and proposed policies.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-2, ECAR-3</IAControls> - - Present - False - False - +Central Access Policy Staging auditing under Object Access is used to enable the recording of events related to differences in permissions between central access policies and proposed policies.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-2, ECAR-3</IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -688,19 +688,19 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Object Access -> Central Policy Staging - Success - Central Policy Staging - - - Success +Object Access -> Central Policy Staging - Success + Central Policy Staging + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Authorization Policy Change records events related to changes in user rights, such as Create a token object.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Authorization Policy Change records events related to changes in user rights, such as Create a token object.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -709,20 +709,20 @@ Use the AuditPol tool to review the current Audit Policy configuration: Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Policy Change -> Authorization Policy Change - Success - Authorization Policy Change - - - Success +Policy Change -> Authorization Policy Change - Success + Authorization Policy Change + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Account Lockout events can be used to identify potentially malicious logon attempts. -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -735,19 +735,19 @@ Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Logon/Logoff >> Account Lockout - Success - Account Lockout - - - Failure +Logon/Logoff >> Account Lockout - Success + Account Lockout + + + Failure <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Account Lockout events can be used to identify potentially malicious logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Account Lockout events can be used to identify potentially malicious logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -758,19 +758,19 @@ Enter "AuditPol /get /category:*" Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -Logon/Logoff >> Account Lockout - Failure - Account Lockout - - - Success +Logon/Logoff >> Account Lockout - Failure + Account Lockout + + + Success <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -783,19 +783,19 @@ Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -System >> Other System Events - Success - Other System Events - - - Failure +System >> Other System Events - Success + Other System Events + + + Failure <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (V-14230) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: @@ -808,21 +808,21 @@ Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding. -System >> Other System Events - Failure - Other System Events - - - - - <VulnDiscussion>Systems at unsupported service packs or releases will not receive security updates for new vulnerabilities, which leave them subject to exploitation. Systems must be maintained at a service pack level supported by the vendor with new security updates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - 6.2.9200 - - False - -le - False - - Version - SELECT * FROM Win32_OperatingSystem +System >> Other System Events - Failure + Other System Events + + + + + <VulnDiscussion>Systems at unsupported service packs or releases will not receive security updates for new vulnerabilities, which leave them subject to exploitation. Systems must be maintained at a service pack level supported by the vendor with new security updates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + 6.2.9200 + + False + -le + False + + Version + SELECT * FROM Win32_OperatingSystem Run "winver.exe". If the "About Windows" dialog box does not display @@ -833,18 +833,18 @@ or greater, this is a finding. No preview versions will be used in a production environment. Unsupported Service Packs/Releases: -Windows 2012 - any release candidates or versions prior to the initial release. - - - <VulnDiscussion>The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system. To support this, local volumes must be formatted using a file system that supports NTFS attributes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - NTFS|ReFS - - False - -match - False - - FileSystem - SELECT * FROM Win32_LogicalDisk WHERE DriveType = '3' +Windows 2012 - any release candidates or versions prior to the initial release. + + + <VulnDiscussion>The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system. To support this, local volumes must be formatted using a file system that supports NTFS attributes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + NTFS|ReFS + + False + -match + False + + FileSystem + SELECT * FROM Win32_LogicalDisk WHERE DriveType = '3' Open "Computer Management". Select "Disk Management" under "Storage". @@ -853,18 +853,18 @@ For each local volume, if the file system does not indicate "NTFS", this is a fi "ReFS" (Resilient File System) is also acceptable and would not be a finding. -This does not apply to system partitions such as the Recovery and EFI System Partition. - - - <VulnDiscussion>Passwords that do not expire or are reused increase the exposure of a password with greater probability of being discovered or cracked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - True - - False - -eq - False - - PasswordExpires - SELECT * FROM Win32_UserAccount WHERE Disabled=False AND LocalAccount=True +This does not apply to system partitions such as the Recovery and EFI System Partition. + + + <VulnDiscussion>Passwords that do not expire or are reused increase the exposure of a password with greater probability of being discovered or cracked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + True + + False + -eq + False + + PasswordExpires + SELECT * FROM Win32_UserAccount WHERE Disabled=False AND LocalAccount=True Review the password never expires status for enabled user accounts. Open "Windows PowerShell" with elevated privileges (run as administrator). @@ -884,18 +884,18 @@ Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordExpires=False a Exclude application accounts and disabled accounts (e.g., Guest). -If any enabled user accounts are returned with a "PasswordExpires" status of "False", this is a finding. - - - <VulnDiscussion>The lack of password protection enables anyone to gain access to the information system, which opens a backdoor opportunity for intruders to compromise the system as well as other resources. Accounts on a system must require passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - True - - False - -eq - False - - PasswordRequired - SELECT * FROM Win32_UserAccount WHERE Disabled=False AND LocalAccount=True +If any enabled user accounts are returned with a "PasswordExpires" status of "False", this is a finding. + + + <VulnDiscussion>The lack of password protection enables anyone to gain access to the information system, which opens a backdoor opportunity for intruders to compromise the system as well as other resources. Accounts on a system must require passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + True + + False + -eq + False + + PasswordRequired + SELECT * FROM Win32_UserAccount WHERE Disabled=False AND LocalAccount=True Review the password required status for enabled user accounts. Open "Windows PowerShell". @@ -904,7 +904,7 @@ Domain Controllers: Enter "Get-ADUser -Filter * -Properties PasswordNotRequired | Where PasswordNotRequired -eq True | FT Name, PasswordNotRequired, Enabled". -Exclude disabled accounts (e.g., Guest). +Exclude disabled accounts (e.g., Guest) and Trusted Domain Objects (TDOs). If "PasswordNotRequired" is "True" for any enabled user account, this is a finding. @@ -914,9 +914,9 @@ Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordRequired=False Exclude disabled accounts (e.g., Guest). -If any enabled user accounts are returned with a "PasswordRequired" status of "False", this is a finding. - - +If any enabled user accounts are returned with a "PasswordRequired" status of "False", this is a finding. + + <VulnDiscussion>Later versions of Windows PowerShell provide additional security and advanced logging features that can provide greater detail when malware has been run on a system. PowerShell 5.x includes the advanced logging features. PowerShell 4.0 with the addition of patch KB3000850 on Windows 2012 R2 or KB3119938 on Windows 2012 adds advanced logging features. PowerShell is updated with the installation of the corresponding version of the Windows Management Framework (WMF). @@ -930,43 +930,43 @@ WMF 5.0: https://docs.microsoft.com/en-us/powershell/wmf/5.0/productincompat WMF 5.1: -https://docs.microsoft.com/en-us/powershell/wmf/5.1/productincompat</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - 6.3.9600.17415 - - False - -ge - False - - Version - SELECT * FROM CIM_Datafile WHERE FileName='powershell' AND Path LIKE '%\\Windows\\System32\\WindowsPowerShell\\v1.0\\%' AND Extension='exe' +https://docs.microsoft.com/en-us/powershell/wmf/5.1/productincompat</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + 6.3.9600.17415 + + False + -ge + False + + Version + SELECT * FROM CIM_Datafile WHERE FileName='powershell' AND Path LIKE '%\\Windows\\System32\\WindowsPowerShell\\v1.0\\%' AND Extension='exe' Open "Windows PowerShell". Enter "$PSVersionTable". If the value for "PSVersion" is not 4.0 or 5.x, this is a finding. -Windows 2012 R2 includes PowerShell 4.0 by default. Windows 2012 must be updated. If PowerShell 4.0 is used, the required patch for script block logging will be verified with the requirement to have that enabled. - - - - - <VulnDiscussion>Shared accounts (accounts where two or more people log in with the same user identification) do not provide adequate identification and authentication. There is no way to provide for nonrepudiation or individual accountability for system access and resource usage.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +Windows 2012 R2 includes PowerShell 4.0 by default. Windows 2012 must be updated. If PowerShell 4.0 is used, the required patch for script block logging will be verified with the requirement to have that enabled. + + + + + <VulnDiscussion>Shared accounts (accounts where two or more people log in with the same user identification) do not provide adequate identification and authentication. There is no way to provide for nonrepudiation or individual accountability for system access and resource usage.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Determine whether any shared accounts exist. If no shared accounts exist, this is NA. Shared accounts, such as required by an application, may be approved by the organization. This must be documented with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity. -If unapproved shared accounts exist, this is a finding. - - - <VulnDiscussion>Outdated or unused accounts provide penetration points that may go undetected. Inactive accounts must be deleted if no longer necessary or, if still required, disabled until needed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +If unapproved shared accounts exist, this is a finding. + + + <VulnDiscussion>Outdated or unused accounts provide penetration points that may go undetected. Inactive accounts must be deleted if no longer necessary or, if still required, disabled until needed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Run "PowerShell". Member servers and standalone systems: @@ -1000,16 +1000,16 @@ Application accounts If any enabled accounts have not been logged on to within the past 35 days, this is a finding. -Inactive accounts that have been reviewed and deemed to be required must be documented with the ISSO. - - +Inactive accounts that have been reviewed and deemed to be required must be documented with the ISSO. + + <VulnDiscussion>The FTP service allows remote users to access shared files and directories. Allowing anonymous FTP connections makes user auditing difficult. -Using accounts that have administrator privileges to log on to FTP risks that the userid and password will be captured on the network and give administrator access to an unauthorized user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +Using accounts that have administrator privileges to log on to FTP risks that the userid and password will be captured on the network and give administrator access to an unauthorized user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + If FTP is not installed on the system, this is NA. Determine the IP address and port number assigned to FTP sites from documentation or configuration. @@ -1041,14 +1041,14 @@ ftp> If the response indicates that an anonymous FTP login was permitted, this is a finding. -If accounts with administrator privileges are used to access FTP, this is a CAT I finding. - - - <VulnDiscussion>The FTP service allows remote users to access shared files and directories. Access outside of the specific directories of shared data could provide access to system resources and compromise the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +If accounts with administrator privileges are used to access FTP, this is a CAT I finding. + + + <VulnDiscussion>The FTP service allows remote users to access shared files and directories. Access outside of the specific directories of shared data could provide access to system resources and compromise the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + If FTP is not installed on the system, this is NA. Determine the IP address and port number assigned to FTP sites from documentation or configuration. @@ -1081,38 +1081,60 @@ Password: "Password" ftp> "Dir" -If the FTP session indicates access to areas of the system other than the specific folder for FTP data, such as the root of the drive, Program Files or Windows directories, this is a finding. - - - <VulnDiscussion>Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Visibility of members of the Backup Operators group must be maintained.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +If the FTP session indicates access to areas of the system other than the specific folder for FTP data, such as the root of the drive, Program Files or Windows directories, this is a finding. + + + <VulnDiscussion>Windows shares are a means by which files, folders, printers, and other resources can be published for network users to access. Improper configuration can permit access to devices and data beyond a user's need.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Open "Devices and Printers" in Control Panel or through Search. +If there are no printers configured, this is NA.(Exclude Microsoft Print to PDF and Microsoft XPS Document Writer, which do not support sharing.) + +For each configured printer: +Right click on the printer. +Select "Printer Properties". +Select the "Sharing" tab. +View whether "Share this printer" is checked. + +For any printers with "Share this printer" selected: +Select the Security tab. + +If any standard user accounts or groups have permissions other than "Print", this is a finding. +Standard users will typically be given "Print" permission through the Everyone group. +"All APPLICATION PACKAGES" and "CREATOR OWNER" are not considered standard user accounts for this requirement. + + + <VulnDiscussion>Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Visibility of members of the Backup Operators group must be maintained.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + If no accounts are members of the Backup Operators group, this is NA. -Any accounts that are members of the Backup Operators group, including application accounts, must be documented with the ISSO. If documentation of accounts that are members of the Backup Operators group is not maintained this is a finding. - - - <VulnDiscussion>A properly configured host-based Intrusion Detection System provides another level of defense against unauthorized access to critical servers. With proper configuration and logging enabled, such a system can stop and/or alert for many attempts to gain unauthorized access to resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance>This finding can be downgraded to a CAT III, if there is an active JIDS or firewall protecting the network. </SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +Any accounts that are members of the Backup Operators group, including application accounts, must be documented with the ISSO. If documentation of accounts that are members of the Backup Operators group is not maintained this is a finding. + + + <VulnDiscussion>A properly configured host-based Intrusion Detection System provides another level of defense against unauthorized access to critical servers. With proper configuration and logging enabled, such a system can stop and/or alert for many attempts to gain unauthorized access to resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance>This finding can be downgraded to a CAT III, if there is an active JIDS or firewall protecting the network. </SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Determine whether there is a host-based Intrusion Detection System on each server. If the HIPS component of HBSS is installed and active on the host and the Alerts of blocked activity are being logged and monitored, this will meet the requirement of this finding. A HID device is not required on a system that has the role as the Network Intrusion Device (NID). However, this exception needs to be documented with the site ISSO. -If a host-based Intrusion Detection System is not installed on the system, this is a finding. - - - <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some services may be run under the local System account, which generally has more permissions than required by the service. Compromising a service could allow an intruder to obtain system permissions and open the system to a variety of attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +If a host-based Intrusion Detection System is not installed on the system, this is a finding. + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some services may be run under the local System account, which generally has more permissions than required by the service. Compromising a service could allow an intruder to obtain system permissions and open the system to a variety of attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Required services will vary between organizations, and on the role of the individual system. Organizations will develop their own list of services which will be documented and justified with the ISSO. The site's list will be provided for any security review. Services common to multiple systems can be addressed in one document. Exceptions for individual systems should be identified separately by system. Individual services specifically required to be disabled per the STIG are identified in separate requirements. @@ -1250,26 +1272,26 @@ Windows Update - Manual WinHTTP Web Proxy Auto-Discovery Service - Manual Wired AutoConfig - Manual WMI Performance Adapter - Manual -Workstation - Automatic - - - <VulnDiscussion>Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +Workstation - Automatic + + + <VulnDiscussion>Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Search all drives for *.p12 and *.pfx files. If any files with these extensions exist, this is a finding. -This does not apply to server-based applications that have a requirement for certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO. - - - <VulnDiscussion>To ensure secure DoD websites and DoD-signed code are properly validated, the system must trust the DoD Root Certificate Authorities (CAs). The DoD root certificates will ensure that the trust chain is established for server certificates issued from the DoD CAs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +This does not apply to server-based applications that have a requirement for certificate files or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO. + + + <VulnDiscussion>To ensure secure DoD websites and DoD-signed code are properly validated, the system must trust the DoD Root Certificate Authorities (CAs). The DoD root certificates will ensure that the trust chain is established for server certificates issued from the DoD CAs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Verify the DoD Root CA certificates are installed as Trusted Root Certification Authorities. The certificates and thumbprints referenced below apply to unclassified systems; see PKE documentation for other networks. @@ -1342,90 +1364,100 @@ Valid to: Sunday, July 25, 2032 DoD Root CA 5 Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B -Valid to: Friday, June 14, 2041 - - - <VulnDiscussion>Administrative accounts may perform any action on a system. Users with administrative accounts must be documented to ensure those with this level of access are clearly identified.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Review the necessary documentation that identifies the members of the Administrators group. If a list of all users belonging to the Administrators group is not maintained with the ISSO, this is a finding. - - +Valid to: Friday, June 14, 2041 + + + <VulnDiscussion>Administrative accounts may perform any action on a system. Users with administrative accounts must be documented to ensure those with this level of access are clearly identified.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the necessary documentation that identifies the members of the Administrators group. If a list of all users belonging to the Administrators group is not maintained with the ISSO, this is a finding. + + + <VulnDiscussion>Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. The operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools..</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify DoD approved HBSS software is installed, configured, and properly operating. Ask the operator to document the HBSS software installation and configuration. + +If the operator is not able to provide a documented configuration for an installed HBSS or if the HBSS software is not properly configured, maintained, or used, this is a finding. + + <VulnDiscussion>Operating system backup is a critical step in maintaining data assurance and availability. Information system and security-related documentation contains information pertaining to system configuration and security settings. -Backups shall be consistent with organizational recovery time and recovery point objectives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Determine whether system-related documentation is backed up in accordance with local recovery time and recovery point objectives. If system-related documentation is not backed up in accordance with local recovery time and recovery point objectives, this is a finding. - - - - - False - False - - Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\ -Type: REG_DWORD -Value Name: Start -Value: 0x00000004 (4) - - - - - False - False - - Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\ -Type: REG_MULTI_SZ -Value Name: DependOnService -Value: Default values after removing MRxSmb10 include the following, which are not a finding: - - - - - <VulnDiscussion>Inadequate physical protection can undermine all other security precautions utilized to protect the system. This can jeopardize the confidentiality, availability, and integrity of the system. Physical security is the first line of protection of any system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Verify servers are located in controlled access areas that are accessible only to authorized personnel. If systems are not adequately protected, this is a finding. - - - <VulnDiscussion>Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +Backups shall be consistent with organizational recovery time and recovery point objectives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine whether system-related documentation is backed up in accordance with local recovery time and recovery point objectives. If system-related documentation is not backed up in accordance with local recovery time and recovery point objectives, this is a finding. + + + + + False + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\ +Type: REG_DWORD +Value Name: Start +Value: 0x00000004 (4) + + + + + False + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\ +Type: REG_MULTI_SZ +Value Name: DependOnService +Value: Default values after removing MRxSmb10 include the following, which are not a finding: + + + + + <VulnDiscussion>Inadequate physical protection can undermine all other security precautions utilized to protect the system. This can jeopardize the confidentiality, availability, and integrity of the system. Physical security is the first line of protection of any system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify servers are located in controlled access areas that are accessible only to authorized personnel. If systems are not adequately protected, this is a finding. + + + <VulnDiscussion>Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution. -If there is no anti-virus solution installed on the system, this is a finding. - - +If there is no anti-virus solution installed on the system, this is a finding. + + <VulnDiscussion>Operating system backup is a critical step in maintaining data assurance and availability. System-level information includes system-state information, operating system and application software, and licenses. -Backups must be consistent with organizational recovery time and recovery point objectives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Determine whether system-level information is backed up in accordance with local recovery time and recovery point objectives. If system-level information is not backed up in accordance with local recovery time and recovery point objectives, this is a finding. - - - <VulnDiscussion>Allowing a system to boot into multiple operating systems (dual-booting) may allow security to be circumvented on a secure system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +Backups must be consistent with organizational recovery time and recovery point objectives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine whether system-level information is backed up in accordance with local recovery time and recovery point objectives. If system-level information is not backed up in accordance with local recovery time and recovery point objectives, this is a finding. + + + <VulnDiscussion>Allowing a system to boot into multiple operating systems (dual-booting) may allow security to be circumvented on a secure system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Verify the local system boots directly into Windows. Open Control Panel. @@ -1434,20 +1466,20 @@ Select the "Advanced System Settings" link. Select the "Advanced" tab. Click the "Startup and Recovery" Settings button. -If the drop-down list box "Default operating system:" shows any operating system other than Windows Server 2012, this is a finding. - - +If the drop-down list box "Default operating system:" shows any operating system other than Windows Server 2012, this is a finding. + + <VulnDiscussion>An account that does not have Administrator duties must not have Administrator rights. Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack. System administrators must log on to systems only using accounts with the minimum level of authority necessary. For domain-joined member servers, the Domain Admins group must be replaced by a domain member server administrator group (see V-36433 in the Active Directory Domain STIG). Restricting highly privileged accounts from the local Administrators group helps mitigate the risk of privilege escalation resulting from credential theft attacks. -Standard user accounts must not be members of the built-in Administrators group.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +Standard user accounts must not be members of the built-in Administrators group.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Review the local Administrators group. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group. For domain-joined member servers, the Domain Admins group must be replaced by a domain member server administrator group. @@ -1456,58 +1488,36 @@ Standard user accounts must not be members of the local Administrator group. If prohibited accounts are members of the local Administrators group, this is a finding. -The built-in Administrator account or other required administrative accounts would not be a finding. - - - <VulnDiscussion>Security configuration tools such as Group Policies and Security Templates allow system administrators to consolidate security-related system settings into a single configuration file. These settings can then be applied consistently to any number of Windows machines.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +The built-in Administrator account or other required administrative accounts would not be a finding. + + + <VulnDiscussion>Security configuration tools such as Group Policies and Security Templates allow system administrators to consolidate security-related system settings into a single configuration file. These settings can then be applied consistently to any number of Windows machines.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Verify security configuration tools or equivalent processes are being used to configure Windows systems to meet security requirements. If security configuration tools or equivalent processes are not used, this is a finding. Security configuration tools that are integrated into Windows, such as Group Policies and Security Templates, may be used to configure platforms for security compliance. -If an alternate method is used to configure a system (e.g., manually using the DISA Windows Security STIGs, etc.) and the same configured result is achieved, this is acceptable. - - - <VulnDiscussion>Windows shares are a means by which files, folders, printers, and other resources can be published for network users to access. Improper configuration can permit access to devices and data beyond a user's need.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Open "Devices and Printers" in Control Panel or through Search. -If there are no printers configured, this is NA. - -For each configured printer: -Right click on the printer. -Select "Printer Properties". -Select the "Sharing" tab. -View whether "Share this printer" is checked. - -For any printers with "Share this printer" selected: -Select the Security tab. - -If any standard user accounts or groups have permissions other than "Print", this is a finding. -Standard users will typically be given "Print" permission through the Everyone group. -"All APPLICATION PACKAGES" and "CREATOR OWNER" are not considered standard user accounts for this requirement. - - - <VulnDiscussion>Monitoring system files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>DCSL-1</IAControls> - - False - False - +If an alternate method is used to configure a system (e.g., manually using the DISA Windows Security STIGs, etc.) and the same configured result is achieved, this is acceptable. + + + <VulnDiscussion>Monitoring system files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>DCSL-1</IAControls> + + False + False + Determine whether the site monitors system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) on servers for unauthorized changes against a baseline on a weekly basis. If system files are not monitored for unauthorized changes, this is a finding. -A properly configured HBSS Policy Auditor 5.2 or later File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement. - - - <VulnDiscussion>Shares on a system provide network access. To prevent exposing sensitive information, where shares are necessary, permissions must be reconfigured to give the minimum access to those accounts that require it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +A properly configured HBSS Policy Auditor 5.2 or later File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement. + + + <VulnDiscussion>Shares on a system provide network access. To prevent exposing sensitive information, where shares are necessary, permissions must be reconfigured to give the minimum access to those accounts that require it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + If only system-created shares such as "ADMIN$", "C$", and "IPC$" exist on the system, this is NA. (System-created shares will display a message that it has been shared for administrative purposes when "Properties" is selected.) @@ -1522,14 +1532,14 @@ If the file shares have not been reconfigured to restrict permissions to the spe Select the "Security" tab. -If the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding. - - - <VulnDiscussion>The Windows Time Service controls time synchronization settings. Time synchronization is essential for authentication and auditing purposes. If the Windows Time Service is used, it must synchronize with a secure, authorized time source. Domain-joined systems are automatically configured to synchronize with domain controllers. If an NTP server is configured, it must synchronize with a secure, authorized time source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +If the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding. + + + <VulnDiscussion>The Windows Time Service controls time synchronization settings. Time synchronization is essential for authentication and auditing purposes. If the Windows Time Service is used, it must synchronize with a secure, authorized time source. Domain-joined systems are automatically configured to synchronize with domain controllers. If an NTP server is configured, it must synchronize with a secure, authorized time source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Open "Windows PowerShell" or an elevated "Command Prompt" (run as administrator). Enter "W32tm /query /configuration". @@ -1540,16 +1550,16 @@ If systems are configured with a "Type" of "NTP", including standalone systems a If an alternate time synchronization tool is used and is not enabled or not configured to synchronize with a DoD time source, this is a finding. -The US Naval Observatory operates stratum 1 time servers, identified at http://tycho.usno.navy.mil/ntp.html. Time synchronization will occur through a hierarchy of time servers down to the local level. Clients and lower-level servers will synchronize with an authorized time server in the hierarchy. - - +The US Naval Observatory operates stratum 1 time servers, identified at http://tycho.usno.navy.mil/ntp.html. Time synchronization will occur through a hierarchy of time servers down to the local level. Clients and lower-level servers will synchronize with an authorized time server in the hierarchy. + + <VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. The password for the built-in Administrator account must be changed at least annually or when any member of the administrative team leaves the organization. -Organizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every "30" days by default.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +Organizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every "30" days by default.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Review the password last set date for the built-in Administrator account. Domain controllers: @@ -1568,14 +1578,14 @@ Enter 'Net User [account name] | Find /i "Password Last Set"', where [account na (The name of the built-in Administrator account must be changed to something other than "Administrator" per STIG requirements.) -If the "PasswordLastSet" date is greater than one year old, this is a finding. - - - <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +If the "PasswordLastSet" date is greater than one year old, this is a finding. + + + <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates. Run "PowerShell" as an administrator. @@ -1634,52 +1644,52 @@ Valid to: Friday, September 6, 2019 Issued To: DoD Root CA 3 Issued By: DoD Interoperability Root CA 2 Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 -Valid to: Saturday, January 22, 2022 - - +Valid to: Saturday, January 22, 2022 + + <VulnDiscussion>Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account. Since administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy requires administrative accounts to not access the Internet or use applications, such as email. The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. -Technical means such as application whitelisting can be used to enforce the policy to ensure compliance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +Technical means such as application whitelisting can be used to enforce the policy to ensure compliance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Determine whether administrative accounts are prevented from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. The organization must have a policy that prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. Technical measures such as the removal of applications or application whitelisting must be used where feasible to prevent the use of applications that access the Internet. -If accounts with administrative privileges are not prevented from using applications that access the Internet or with potential Internet sources, this is a finding. - - - <VulnDiscussion>Using a privileged account to perform routine functions makes the computer vulnerable to malicious software inadvertently introduced during a session that has been granted full privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLP-1</IAControls> - - False - False - +If accounts with administrative privileges are not prevented from using applications that access the Internet or with potential Internet sources, this is a finding. + + + <VulnDiscussion>Using a privileged account to perform routine functions makes the computer vulnerable to malicious software inadvertently introduced during a session that has been granted full privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLP-1</IAControls> + + False + False + Verify each user with administrative privileges has been assigned a unique administrative account separate from their standard user account. -If users with administrative privileges do not have separate accounts for administrative functions and standard user functions, this is a finding. - - - <VulnDiscussion>Application/service account passwords must be of sufficient length to prevent being easily cracked. Application/service accounts that are manually managed must have passwords at least 15 characters in length.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IAIA-1</IAControls> - - False - False - - Verify the site has a policy to ensure passwords for manually managed application/service accounts are at least 15 characters in length. If such a policy does not exist or has not been implemented, this is a finding. - - - <VulnDiscussion>Setting application accounts to expire may cause applications to stop functioning. However, not changing them on a regular basis exposes them to attack. If managed service accounts are used, this alleviates the need to manually change application account passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +If users with administrative privileges do not have separate accounts for administrative functions and standard user functions, this is a finding. + + + <VulnDiscussion>Application/service account passwords must be of sufficient length to prevent being easily cracked. Application/service accounts that are manually managed must have passwords at least 15 characters in length.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IAIA-1</IAControls> + + False + False + + Verify the site has a policy to ensure passwords for manually managed application/service accounts are at least 15 characters in length. If such a policy does not exist or has not been implemented, this is a finding. + + + <VulnDiscussion>Setting application accounts to expire may cause applications to stop functioning. However, not changing them on a regular basis exposes them to attack. If managed service accounts are used, this alleviates the need to manually change application account passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Determine if manually managed application/service accounts exist. If none exist, this is NA. If passwords for manually managed application/service accounts are not changed at least annually or when an administrator with knowledge of the password leaves the organization, this is a finding. @@ -1702,92 +1712,84 @@ Open "Windows PowerShell" or "Command Prompt". Enter 'Net User [application account name] | Find /i "Password Last Set"', where [application account name] is the name of the manually managed application/service account. -If the "Password Last Set" date is more than one year old, this is a finding. - - - <VulnDiscussion>If SAs are assigned to systems running operating systems for which they have no training, these systems are at additional risk of unintentional misconfiguration that may result in vulnerabilities or decreased availability of the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLP-1</IAControls> - - False - False - - Determine whether the site has a policy that requires SAs be trained for all operating systems running on systems under their control. If the site does not have a policy requiring SAs be trained for all operating systems under their control, this is a finding. - - - <VulnDiscussion>To be of value, audit logs from critical systems must be reviewed on a regular basis. Critical systems should be reviewed on a daily basis to identify security breaches and potential weaknesses in the security structure. This can be done with the use of monitoring software or other utilities for this purpose.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAT-1, ECAT-2</IAControls> - - False - False - - Determine whether audit logs are reviewed on a predetermined schedule. If audit logs are not reviewed on a regular basis, this is a finding. - - - <VulnDiscussion>Audit records are essential for investigating system activity after the fact. Retention periods for audit data are determined based on the sensitivity of the data handled by the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECRR-1</IAControls> - - False - False - - Determine whether audit data is retained for at least one year. If the audit data is not retained for at least a year, this is a finding. - - - <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Determine if a process to back up log data to a different system or media than the system being audited has been implemented. If it has not, this is a finding. - - +If the "Password Last Set" date is more than one year old, this is a finding. + + + <VulnDiscussion>If SAs are assigned to systems running operating systems for which they have no training, these systems are at additional risk of unintentional misconfiguration that may result in vulnerabilities or decreased availability of the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLP-1</IAControls> + + False + False + + Determine whether the site has a policy that requires SAs be trained for all operating systems running on systems under their control. If the site does not have a policy requiring SAs be trained for all operating systems under their control, this is a finding. + + + <VulnDiscussion>To be of value, audit logs from critical systems must be reviewed on a regular basis. Critical systems should be reviewed on a daily basis to identify security breaches and potential weaknesses in the security structure. This can be done with the use of monitoring software or other utilities for this purpose.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAT-1, ECAT-2</IAControls> + + False + False + + Determine whether audit logs are reviewed on a predetermined schedule. If audit logs are not reviewed on a regular basis, this is a finding. + + + <VulnDiscussion>Audit records are essential for investigating system activity after the fact. Retention periods for audit data are determined based on the sensitivity of the data handled by the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECRR-1</IAControls> + + False + False + + Determine whether audit data is retained for at least one year. If the audit data is not retained for at least a year, this is a finding. + + + <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine if a process to back up log data to a different system or media than the system being audited has been implemented. If it has not, this is a finding. + + <VulnDiscussion>Operating system backup is a critical step in maintaining data assurance and availability. User-level information is data generated by information system and/or application users. -Backups shall be consistent with organizational recovery time and recovery point objectives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Determine whether user-level information is backed up in accordance with local recovery time and recovery point objectives. If user-level information is not backed up in accordance with local recovery time and recovery point objectives, this is a finding. - - - <VulnDiscussion>Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. The operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools..</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Verify the operating system employs automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where HBSS is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP). If it does not, this is a finding. - - - <VulnDiscussion>The organization (including any contractor to the organization) must promptly install security-relevant software updates (e.g., patches, service packs, hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Verify the organization has an automated process to install security-related software updates. If it does not, this is a finding. - - - <VulnDiscussion>A system backup will usually include sensitive information such as user accounts that could be used in an attack. As a valuable system resource, the system backup must be protected and stored in a physically secure location.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>CODB-2</IAControls> - - False - False - - Determine if system-level information backups are protected from destruction and stored in a physically secure location. If they are not, this is a finding. - - - <VulnDiscussion>Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Members of the Backup Operators group must have separate logon accounts for performing backup duties.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLP-1</IAControls> - - False - False - +Backups shall be consistent with organizational recovery time and recovery point objectives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine whether user-level information is backed up in accordance with local recovery time and recovery point objectives. If user-level information is not backed up in accordance with local recovery time and recovery point objectives, this is a finding. + + + <VulnDiscussion>The organization (including any contractor to the organization) must promptly install security-relevant software updates (e.g., patches, service packs, hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify the organization has an automated process to install security-related software updates. If it does not, this is a finding. + + + <VulnDiscussion>A system backup will usually include sensitive information such as user accounts that could be used in an attack. As a valuable system resource, the system backup must be protected and stored in a physically secure location.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>CODB-2</IAControls> + + False + False + + Determine if system-level information backups are protected from destruction and stored in a physically secure location. If they are not, this is a finding. + + + <VulnDiscussion>Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Members of the Backup Operators group must have separate logon accounts for performing backup duties.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLP-1</IAControls> + + False + False + If no accounts are members of the Backup Operators group, this is NA. -Verify users with accounts in the Backup Operators group have a separate user account for backup functions and for performing normal user tasks. If users with accounts in the Backup Operators group do not have separate accounts for backup functions and standard user functions, this is a finding. - - - <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +Verify users with accounts in the Backup Operators group have a separate user account for backup functions and for performing normal user tasks. If users with accounts in the Backup Operators group do not have separate accounts for backup functions and standard user functions, this is a finding. + + + <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate. Run "PowerShell" as an administrator. @@ -1836,16 +1838,16 @@ If an expired certificate ("Valid to" date) is not listed in the results, this i Issued To: DoD Root CA 3 Issuer by: US DoD CCEB Interoperability Root CA 2 Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E -Valid: Friday, September 27, 2019 - - +Valid: Friday, September 27, 2019 + + <VulnDiscussion>Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. -The organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +The organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + This is applicable to unclassified systems; for other systems this is NA. Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. @@ -1869,42 +1871,42 @@ This will produce an xml file with the effective settings that can be viewed in Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link: -https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm - - +https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm + + <VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. Ensuring the confidentiality of transmitted information requires the operating system to take measures in preparing information for transmission. This can be accomplished via access control and encryption. -Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, operating systems need to support transmission protection mechanisms such as TLS, encrypted VPNs, or IPSEC.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - If the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, verify protection methods such as TLS, encrypted VPNs, or IPSEC have been implemented. If protection methods have not been implemented, this is a finding. - - +Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, operating systems need to support transmission protection mechanisms such as TLS, encrypted VPNs, or IPSEC.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, verify protection methods such as TLS, encrypted VPNs, or IPSEC have been implemented. If protection methods have not been implemented, this is a finding. + + <VulnDiscussion>This requirement addresses protection of user-generated data, as well as operating system-specific configuration data. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate, in accordance with the security category and/or classification of the information. -Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Verify systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data employ encryption to protect the confidentiality and integrity of all information at rest. If it does not, this is a finding. - - +Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data employ encryption to protect the confidentiality and integrity of all information at rest. If it does not, this is a finding. + + <VulnDiscussion>If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation. Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. If temporary accounts are used, the operating system must be configured to automatically terminate these types of accounts after a DoD-defined time period of 72 hours. -To address access requirements, many operating systems may be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +To address access requirements, many operating systems may be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Determine if temporary user accounts are used and identify any that exist. If none exist, this is NA. Review temporary user accounts for expiration dates. @@ -1929,18 +1931,18 @@ Enter "Net User [username]", where [username] is the name of the temporary user If "Account expires" has not been defined within 72 hours for any temporary user account, this is a finding. -If the "Password last set" date and "Account expires" date are greater than 72 hours apart, this is a finding. (Net User does not provide an account creation date.) - - +If the "Password last set" date and "Account expires" date are greater than 72 hours apart, this is a finding. (Net User does not provide an account creation date.) + + <VulnDiscussion>Emergency administrator accounts are privileged accounts which are established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability. Emergency administrator accounts are different from infrequently used accounts (i.e., local logon accounts used by system administrators when network or normal logon/access is not available). Infrequently used accounts are not subject to automatic termination dates. Emergency accounts are accounts created in response to crisis situations, usually for use by maintenance personnel. The automatic expiration or disabling time period may be extended as needed until the crisis is resolved; however, it must not be extended indefinitely. A permanent account should be established for privileged users who need long-term maintenance accounts. -To address access requirements, many operating systems can be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +To address access requirements, many operating systems can be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Determine if emergency administrator accounts are used and identify any that exist. If none exist, this is NA. If emergency administrator accounts cannot be configured with an expiration date due to an ongoing crisis, the accounts must be disabled or removed when the crisis is resolved. @@ -1965,22 +1967,22 @@ Enter "Net User [username]", where [username] is the name of the emergency admin If "Account expires" has not been defined within 72 hours for any emergency administrator accounts, this is a finding. -If the "Password last set" date and "Account expires" date are greater than 72 hours apart, this is a finding. (Net User does not provide an account creation date.) - - - <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Verify the operating system, at a minimum, off-loads audit records of interconnected systems in real time and off-loads standalone systems weekly. If it does not, this is a finding. - - - <VulnDiscussion>Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups. If the account or group objects are reanimated, there is a potential they may still have rights no longer intended. Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - +If the "Password last set" date and "Account expires" date are greater than 72 hours apart, this is a finding. (Net User does not provide an account creation date.) + + + <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify the operating system, at a minimum, off-loads audit records of interconnected systems in real time and off-loads standalone systems weekly. If it does not, this is a finding. + + + <VulnDiscussion>Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups. If the account or group objects are reanimated, there is a potential they may still have rights no longer intended. Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + Review the effective User Rights setting in Local Group Policy Editor. Run "gpedit.msc". @@ -1988,44 +1990,44 @@ Navigate to Local Computer Policy >> Computer Configuration >> Windo Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of "*S-1-…".) -If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding. - - - - - - - - - Administrators - False - This Key and Subkeys - FullControl - - - - - Backup Operators - False - This Key Only - ReadKey - - - - - LOCAL SERVICE - False - This Key and Subkeys - ReadKey - - - <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Some processes may require anonymous access to the registry. This must be limited to properly protect the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\ +If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding. + + + + + + + + + Administrators + False + This Key and Subkeys + FullControl + + + + + Backup Operators + False + This Key Only + ReadKey + + + + + LOCAL SERVICE + False + This Key and Subkeys + ReadKey + + + <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Some processes may require anonymous access to the registry. This must be limited to properly protect the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + HKLM:\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\ Run "Regedit". Navigate to the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\ @@ -2044,58 +2046,58 @@ Inherited from - None Columns: Principal - Access - Applies to Administrators - Full Control - This key and subkeys Backup Operators - Read - This key only -LOCAL SERVICE - Read - This key and subkeys - - - - - - - TrustedInstaller - False - This Key and Subkeys - FullControl - - - - - SYSTEM - False - This Key and Subkeys - FullControl - - - - - Administrators - False - This Key and Subkeys - FullControl - - - - - Users - False - This Key and Subkeys - ReadKey - - - - - ALL APPLICATION PACKAGES - False - This Key and Subkeys - ReadKey - - - <VulnDiscussion>Permissions on the Winlogon registry key must only allow privileged accounts to change registry values. If standard users have these permissions, there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ +LOCAL SERVICE - Read - This key and subkeys + + + + + + + TrustedInstaller + False + This Key and Subkeys + FullControl + + + + + SYSTEM + False + This Key and Subkeys + FullControl + + + + + Administrators + False + This Key and Subkeys + FullControl + + + + + Users + False + This Key and Subkeys + ReadKey + + + + + ALL APPLICATION PACKAGES + False + This Key and Subkeys + ReadKey + + + <VulnDiscussion>Permissions on the Winlogon registry key must only allow privileged accounts to change registry values. If standard users have these permissions, there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ Run "Regedit". Navigate to the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ @@ -2115,62 +2117,62 @@ TrustedInstaller - Full Control SYSTEM - Full Control Administrators - Full Control Users - Read -ALL APPLICATION PACKAGES - Read - - - - - - - Users - False - - - ReadKey - - - - - Administrators - False - - - FullControl - - - - - SYSTEM - False - - - FullControl - - - - - CREATOR OWNER - False - Subkeys Only - FullControl - - - - - ALL APPLICATION PACKAGES - False - - - ReadKey - - - <VulnDiscussion>Permissions on the Active Setup\Installed Components registry key must only allow privileged accounts to add or change registry values. If standard user accounts have these permissions, there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - HKLM:\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\ +ALL APPLICATION PACKAGES - Read + + + + + + + Users + False + + + ReadKey + + + + + Administrators + False + + + FullControl + + + + + SYSTEM + False + + + FullControl + + + + + CREATOR OWNER + False + Subkeys Only + FullControl + + + + + ALL APPLICATION PACKAGES + False + + + ReadKey + + + <VulnDiscussion>Permissions on the Active Setup\Installed Components registry key must only allow privileged accounts to add or change registry values. If standard user accounts have these permissions, there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + HKLM:\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\ Run "Regedit". Navigate to the following registry keys and review the permissions: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\ @@ -2182,45 +2184,45 @@ Users - Read Administrators - Full Control SYSTEM - Full Control CREATOR OWNER - Full Control (Subkeys only) -ALL APPLICATION PACKAGES - Read - - - - - - - Eventlog - False - - - FullControl - - - - - SYSTEM - False - - - FullControl - - - - - Administrators - False - - - FullControl - - - <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Application event log may be susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECTP-1</IAControls> - - True - False - False - - %windir%\SYSTEM32\WINEVT\LOGS\Application.evtx +ALL APPLICATION PACKAGES - Read + + + + + + + Eventlog + False + + + FullControl + + + + + SYSTEM + False + + + FullControl + + + + + Administrators + False + + + FullControl + + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Application event log may be susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECTP-1</IAControls> + + True + False + False + + %windir%\SYSTEM32\WINEVT\LOGS\Application.evtx Verify the permissions on the Application event log (Application.evtx). Standard user accounts or groups must not have greater than Read access. The default permissions listed below satisfy this requirement: Eventlog - Full Control @@ -2229,45 +2231,45 @@ Administrators - Full Control The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder. -If the permissions for these files are not as restrictive as the ACLs listed, this is a finding. - - - - - - - Eventlog - False - - - FullControl - - - - - SYSTEM - False - - - FullControl - - - - - Administrators - False - - - FullControl - - - <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Security event log may disclose sensitive information or be susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECTP-1</IAControls> - - True - False - False - - %windir%\SYSTEM32\WINEVT\LOGS\Security.evtx +If the permissions for these files are not as restrictive as the ACLs listed, this is a finding. + + + + + + + Eventlog + False + + + FullControl + + + + + SYSTEM + False + + + FullControl + + + + + Administrators + False + + + FullControl + + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Security event log may disclose sensitive information or be susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECTP-1</IAControls> + + True + False + False + + %windir%\SYSTEM32\WINEVT\LOGS\Security.evtx Verify the permissions on the Security event log (Security.evtx). Standard user accounts or groups must not have access. The default permissions listed below satisfy this requirement: Eventlog - Full Control @@ -2276,45 +2278,45 @@ Administrators - Full Control The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder. -If the permissions for these files are not as restrictive as the ACLs listed, this is a finding. - - - - - - - Eventlog - False - - - FullControl - - - - - SYSTEM - False - - - FullControl - - - - - Administrators - False - - - FullControl - - - <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The System event log may be susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECTP-1</IAControls> - - True - False - False - - %windir%\SYSTEM32\WINEVT\LOGS\System.evtx +If the permissions for these files are not as restrictive as the ACLs listed, this is a finding. + + + + + + + Eventlog + False + + + FullControl + + + + + SYSTEM + False + + + FullControl + + + + + Administrators + False + + + FullControl + + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The System event log may be susceptible to tampering if proper permissions are not applied.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECTP-1</IAControls> + + True + False + False + + %windir%\SYSTEM32\WINEVT\LOGS\System.evtx Verify the permissions on the System event log (System.evtx). Standard user accounts or groups must not have greater than Read access. The default permissions listed below satisfy this requirement: Eventlog - Full Control @@ -2323,298 +2325,298 @@ Administrators - Full Control The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder. -If the permissions for these files are not as restrictive as the ACLs listed, this is a finding. - - - - - - - TrustedInstaller - False - This folder and subfolders - FullControl - - - - - SYSTEM - False - This folder only - Modify - - - - - SYSTEM - False - Subfolders and files only - FullControl - - - - - Administrators - False - This folder only - Modify - - - - - Administrators - False - Subfolders and files only - FullControl - - - - - Users - False - This folder subfolders and files - ReadAndExecute - - - - - CREATOR OWNER - False - Subfolders and files only - FullControl - - - - - ALL APPLICATION PACKAGES - False - This folder subfolders and files - ReadAndExecute - - +If the permissions for these files are not as restrictive as the ACLs listed, this is a finding. + + + + + + + TrustedInstaller + False + This folder and subfolders + FullControl + + + + + SYSTEM + False + This folder only + Modify + + + + + SYSTEM + False + Subfolders and files only + FullControl + + + + + Administrators + False + This folder only + Modify + + + + + Administrators + False + Subfolders and files only + FullControl + + + + + Users + False + This folder subfolders and files + ReadAndExecute + + + + + CREATOR OWNER + False + Subfolders and files only + FullControl + + + + + ALL APPLICATION PACKAGES + False + This folder subfolders and files + ReadAndExecute + + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. -The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - %ProgramFiles(x86)% - The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377). If the default ACLs are maintained and the referenced option is set to "Disabled", this is not a finding. -Verify the default permissions for the program file directories (Program Files and Program Files (x86)). Nonprivileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) -Viewing in File Explorer: -For each folder, view the Properties. -Select the "Security" tab, and the "Advanced" button. -Default Permissions: -\Program Files (x86) -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -TrustedInstaller - Full control - This folder and subfolders -SYSTEM - Modify - This folder only -SYSTEM - Full control - Subfolders and files only -Administrators - Modify - This folder only -Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders and files -CREATOR OWNER - Full control - Subfolders and files only -ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files -Alternately, use Icacls: -Open a Command prompt (admin). -Enter icacls followed by the directory: -icacls "c:\program files" -icacls "c:\program files (x86)" -The following results should be displayed as each is entered: -c:\program files -NT SERVICE\TrustedInstaller:(F) -NT SERVICE\TrustedInstaller:(CI)(IO)(F) -NT AUTHORITY\SYSTEM:(M) -NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) -BUILTIN\Administrators:(M) -BUILTIN\Administrators:(OI)(CI)(IO)(F) -BUILTIN\Users:(RX) -BUILTIN\Users:(OI)(CI)(IO)(GR,GE) -CREATOR OWNER:(OI)(CI)(IO)(F) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -Successfully processed 1 files; Failed processing 0 files - - - - - - - - TrustedInstaller - False - This folder and subfolders - FullControl - - - - - SYSTEM - False - This folder only - Modify - - - - - SYSTEM - False - Subfolders and files only - FullControl - - - - - Administrators - False - This folder only - Modify - - - - - Administrators - False - Subfolders and files only - FullControl - - - - - Users - False - This folder subfolders and files - ReadAndExecute - - - - - CREATOR OWNER - False - Subfolders and files only - FullControl - - - - - ALL APPLICATION PACKAGES - False - This folder subfolders and files - ReadAndExecute - - +The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %ProgramFiles(x86)% + The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377). If the default ACLs are maintained and the referenced option is set to "Disabled", this is not a finding. +Verify the default permissions for the program file directories (Program Files and Program Files (x86)). Nonprivileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) +Viewing in File Explorer: +For each folder, view the Properties. +Select the "Security" tab, and the "Advanced" button. +Default Permissions: +\Program Files (x86) +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files +Alternately, use Icacls: +Open a Command prompt (admin). +Enter icacls followed by the directory: +icacls "c:\program files" +icacls "c:\program files (x86)" +The following results should be displayed as each is entered: +c:\program files +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 files + + + + + + + + TrustedInstaller + False + This folder and subfolders + FullControl + + + + + SYSTEM + False + This folder only + Modify + + + + + SYSTEM + False + Subfolders and files only + FullControl + + + + + Administrators + False + This folder only + Modify + + + + + Administrators + False + Subfolders and files only + FullControl + + + + + Users + False + This folder subfolders and files + ReadAndExecute + + + + + CREATOR OWNER + False + Subfolders and files only + FullControl + + + + + ALL APPLICATION PACKAGES + False + This folder subfolders and files + ReadAndExecute + + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. -The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - %ProgramFiles% - The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377). If the default ACLs are maintained and the referenced option is set to "Disabled", this is not a finding. -Verify the default permissions for the program file directories (Program Files and Program Files (x86)). Nonprivileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) -Viewing in File Explorer: -For each folder, view the Properties. -Select the "Security" tab, and the "Advanced" button. -Default Permissions: -\Program Files -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -TrustedInstaller - Full control - This folder and subfolders -SYSTEM - Modify - This folder only -SYSTEM - Full control - Subfolders and files only -Administrators - Modify - This folder only -Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders and files -CREATOR OWNER - Full control - Subfolders and files only -ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files -Alternately, use Icacls: -Open a Command prompt (admin). -Enter icacls followed by the directory: -icacls "c:\program files" -icacls "c:\program files (x86)" -The following results should be displayed as each is entered: -c:\program files -NT SERVICE\TrustedInstaller:(F) -NT SERVICE\TrustedInstaller:(CI)(IO)(F) -NT AUTHORITY\SYSTEM:(M) -NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) -BUILTIN\Administrators:(M) -BUILTIN\Administrators:(OI)(CI)(IO)(F) -BUILTIN\Users:(RX) -BUILTIN\Users:(OI)(CI)(IO)(GR,GE) -CREATOR OWNER:(OI)(CI)(IO)(F) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -Successfully processed 1 files; Failed processing 0 files - - - - - - - - SYSTEM - False - This folder subfolders and files - FullControl - - - - - Administrators - False - This folder subfolders and files - FullControl - - - - - Users - False - This folder subfolders and files - ReadAndExecute - - - - - Users - False - This folder and subfolders - CreateDirectories,AppendData - - - - - Users - False - Subfolders only - CreateFiles,WriteData - - - - - CREATOR OWNER - False - Subfolders and files only - FullControl - - +The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %ProgramFiles% + The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377). If the default ACLs are maintained and the referenced option is set to "Disabled", this is not a finding. +Verify the default permissions for the program file directories (Program Files and Program Files (x86)). Nonprivileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) +Viewing in File Explorer: +For each folder, view the Properties. +Select the "Security" tab, and the "Advanced" button. +Default Permissions: +\Program Files +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files +Alternately, use Icacls: +Open a Command prompt (admin). +Enter icacls followed by the directory: +icacls "c:\program files" +icacls "c:\program files (x86)" +The following results should be displayed as each is entered: +c:\program files +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 files + + + + + + + + SYSTEM + False + This folder subfolders and files + FullControl + + + + + Administrators + False + This folder subfolders and files + FullControl + + + + + Users + False + This folder subfolders and files + ReadAndExecute + + + + + Users + False + This folder and subfolders + CreateDirectories,AppendData + + + + + Users + False + Subfolders only + CreateFiles,WriteData + + + + + CREATOR OWNER + False + Subfolders and files only + FullControl + + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. -The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - %SystemDrive%\ +The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %SystemDrive%\ The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377). If the default ACLs are maintained and the referenced option is set to "Disabled", this is not a finding. Verify the default permissions for the system drive's root directory (usually C:\). Nonprivileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) @@ -2652,84 +2654,84 @@ BUILTIN\Users:(OI)(CI)(RX) BUILTIN\Users:(CI)(AD) BUILTIN\Users:(CI)(IO)(WD) CREATOR OWNER:(OI)(CI)(IO)(F) -Successfully processed 1 files; Failed processing 0 files - - - - - - - TrustedInstaller - False - This folder and subfolders - FullControl - - - - - SYSTEM - False - This folder only - Modify - - - - - SYSTEM - False - Subfolders and files only - FullControl - - - - - Administrators - False - This folder only - Modify - - - - - Administrators - False - Subfolders and files only - FullControl - - - - - Users - False - This folder subfolders and files - ReadAndExecute - - - - - CREATOR OWNER - False - Subfolders and files only - FullControl - - - - - ALL APPLICATION PACKAGES - False - This folder subfolders and files - ReadAndExecute - - +Successfully processed 1 files; Failed processing 0 files + + + + + + + TrustedInstaller + False + This folder and subfolders + FullControl + + + + + SYSTEM + False + This folder only + Modify + + + + + SYSTEM + False + Subfolders and files only + FullControl + + + + + Administrators + False + This folder only + Modify + + + + + Administrators + False + Subfolders and files only + FullControl + + + + + Users + False + This folder subfolders and files + ReadAndExecute + + + + + CREATOR OWNER + False + Subfolders and files only + FullControl + + + + + ALL APPLICATION PACKAGES + False + This folder subfolders and files + ReadAndExecute + + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. -The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - %windir% +The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %windir% The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (V-3377). If the default ACLs are maintained and the referenced option is set to "Disabled", this is not a finding. Verify the default permissions for the Windows installation directory (usually C:\Windows). Nonprivileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) @@ -2775,65 +2777,65 @@ BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -Successfully processed 1 files; Failed processing 0 files - - - - - - - TrustedInstaller - False - - - FullControl - - - - - Administrators - False - - - ReadAndExecute - - - - - SYSTEM - False - - - ReadAndExecute - - - - - Users - False - - - ReadAndExecute - - - - - ALL APPLICATION PACKAGES - False - - - ReadAndExecute - - +Successfully processed 1 files; Failed processing 0 files + + + + + + + TrustedInstaller + False + + + FullControl + + + + + Administrators + False + + + ReadAndExecute + + + + + SYSTEM + False + + + ReadAndExecute + + + + + Users + False + + + ReadAndExecute + + + + + ALL APPLICATION PACKAGES + False + + + ReadAndExecute + + <VulnDiscussion>Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. -Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order to make access decisions regarding the modification or deletion of audit tools.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - %windir%\SYSTEM32\eventvwr.exe +Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order to make access decisions regarding the modification or deletion of audit tools.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %windir%\SYSTEM32\eventvwr.exe Verify the permissions on Event Viewer only allow TrustedInstaller permissions to change or modify. If any groups or accounts other than TrustedInstaller have Full control or Modify, this is a finding. Navigate to "%SystemRoot%\SYSTEM32". @@ -2841,18 +2843,18 @@ View the permissions on "Eventvwr.exe". The default permissions below satisfy this requirement. TrustedInstaller - Full Control -Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES - Read & Execute - - - - - <VulnDiscussion>Displaying the shutdown button may allow individuals to shut down a system anonymously. Only authenticated users should be allowed to shut down the system. Preventing display of this button in the logon dialog box ensures that individuals who shut down the system are authorized and tracked in the system's Security event log.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System - False - +Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES - Read & Execute + + + + + <VulnDiscussion>Displaying the shutdown button may allow individuals to shut down a system anonymously. Only authenticated users should be allowed to shut down the system. Preventing display of this button in the logon dialog box ensures that individuals who shut down the system are authorized and tracked in the system's Security event log.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -2861,19 +2863,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: ShutdownWithoutLogon Value Type: REG_DWORD -Value: 0 - 0 - ShutdownWithoutLogon - Dword - - - <VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System - False - +Value: 0 + 0 + ShutdownWithoutLogon + Dword + + + <VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -2896,31 +2898,31 @@ By using this IS (which includes any device attached to this IS), you consent to -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. --Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. - You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. - -By using this IS (which includes any device attached to this IS), you consent to the following conditions: - --The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. - --At any time, the USG may inspect and seize data stored on this IS. - --Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. - --This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. - --Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. - LegalNoticeText - String - - - <VulnDiscussion>The default Windows configuration caches the last logon credentials for users who log on interactively to a system. This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable. Even though the credential cache is well-protected, if a system is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon - True - '{0}' -le '4' +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. + You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. + +By using this IS (which includes any device attached to this IS), you consent to the following conditions: + +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. + +-At any time, the USG may inspect and seize data stored on this IS. + +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. + +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. + +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. + LegalNoticeText + String + + + <VulnDiscussion>The default Windows configuration caches the last logon credentials for users who log on interactively to a system. This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable. Even though the credential cache is well-protected, if a system is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon + True + '{0}' -le '4' If the system is not a member of a domain, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -2931,19 +2933,19 @@ Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value Name: CachedLogonsCount Value Type: REG_SZ -Value: 4 (or less) - - CachedLogonsCount - String - - - <VulnDiscussion>Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa - False - +Value: 4 (or less) + + CachedLogonsCount + String + + + <VulnDiscussion>Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -2952,19 +2954,19 @@ Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymous Value Type: REG_DWORD -Value: 1 - 1 - RestrictAnonymous - Dword - - - <VulnDiscussion>Users must not be permitted to remain logged on to the network after they have exceeded their permitted logon hours. In many cases, this indicates that a user forgot to log off before leaving for the day. However, it may also indicate that a user is attempting unauthorized access at a time when the system may be less closely monitored. Forcibly disconnecting users when logon hours expire protects critical and sensitive network data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters - False - +Value: 1 + 1 + RestrictAnonymous + Dword + + + <VulnDiscussion>Users must not be permitted to remain logged on to the network after they have exceeded their permitted logon hours. In many cases, this indicates that a user forgot to log off before leaving for the day. However, it may also indicate that a user is attempting unauthorized access at a time when the system may be less closely monitored. Forcibly disconnecting users when logon hours expire protects critical and sensitive network data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -2973,19 +2975,19 @@ Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: EnableForcedLogoff Value Type: REG_DWORD -Value: 1 - 1 - EnableForcedLogoff - Dword - - - <VulnDiscussion>Some non-Microsoft SMB servers only support unencrypted (plain text) password authentication. Sending plain text passwords across the network, when authenticating to an SMB server, reduces the overall security of the environment. Check with the vendor of the SMB server to see if there is a way to support encrypted password authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters - False - +Value: 1 + 1 + EnableForcedLogoff + Dword + + + <VulnDiscussion>Some non-Microsoft SMB servers only support unencrypted (plain text) password authentication. Sending plain text passwords across the network, when authenticating to an SMB server, reduces the overall security of the environment. Check with the vendor of the SMB server to see if there is a way to support encrypted password authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -2994,19 +2996,19 @@ Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ Value Name: EnablePlainTextPassword Value Type: REG_DWORD -Value: 0 - 0 - EnablePlainTextPassword - Dword - - - <VulnDiscussion>Allowing a system to automatically log on when the machine is booted could give access to any unauthorized individual who restarts the computer. Automatic logon with administrator privileges would give full access to an unauthorized individual.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance>If the DefaultName or DefaultDomainName in the same registry path contain an administrator account name and the DefaultPassword contains a value, this is a CAT I finding.</SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon - False - +Value: 0 + 0 + EnablePlainTextPassword + Dword + + + <VulnDiscussion>Allowing a system to automatically log on when the machine is booted could give access to any unauthorized individual who restarts the computer. Automatic logon with administrator privileges would give full access to an unauthorized individual.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance>If the DefaultName or DefaultDomainName in the same registry path contain an administrator account name and the DefaultPassword contains a value, this is a CAT I finding.</SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3015,19 +3017,19 @@ Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value Name: AutoAdminLogon Type: REG_SZ -Value: 0 - 0 - AutoAdminLogon - String - - - <VulnDiscussion>Allowing users to install drivers can introduce malware or cause the instability of a system. Print driver installation should be restricted to administrators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers - False - +Value: 0 + 0 + AutoAdminLogon + String + + + <VulnDiscussion>Allowing users to install drivers can introduce malware or cause the instability of a system. Print driver installation should be restricted to administrators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3036,19 +3038,19 @@ Registry Path: \System\CurrentControlSet\Control\Print\Providers\LanMan Print Se Value Name: AddPrinterDrivers Value Type: REG_DWORD -Value: 1 - 1 - AddPrinterDrivers - Dword - - - <VulnDiscussion>The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts. NTLM, which is less secure, is retained in later Windows versions for compatibility with clients and servers that are running earlier versions of Windows or applications that still use it. It is also used to authenticate logons to stand-alone computers that are running later versions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa - False - +Value: 1 + 1 + AddPrinterDrivers + Dword + + + <VulnDiscussion>The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts. NTLM, which is less secure, is retained in later Windows versions for compatibility with clients and servers that are running earlier versions of Windows or applications that still use it. It is also used to authenticate logons to stand-alone computers that are running later versions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3057,19 +3059,19 @@ Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: LmCompatibilityLevel Value Type: REG_DWORD -Value: 5 - 5 - LmCompatibilityLevel - Dword - - - <VulnDiscussion>Disabling the Ctrl+Alt+Del security attention sequence can compromise system security. Because only Windows responds to the Ctrl+Alt+Del security sequence, a user can be assured that any passwords entered following that sequence are sent only to Windows. If the sequence requirement is eliminated, malicious programs can request and receive a user's Windows password. Disabling this sequence also suppresses a custom logon banner.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System - False - +Value: 5 + 5 + LmCompatibilityLevel + Dword + + + <VulnDiscussion>Disabling the Ctrl+Alt+Del security attention sequence can compromise system security. Because only Windows responds to the Ctrl+Alt+Del security sequence, a user can be assured that any passwords entered following that sequence are sent only to Windows. If the sequence requirement is eliminated, malicious programs can request and receive a user's Windows password. Disabling this sequence also suppresses a custom logon banner.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3078,19 +3080,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: DisableCAD Value Type: REG_DWORD -Value: 0 - 0 - DisableCAD - Dword - - - <VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked. Configuring a system to lock when a smart card is removed will ensure the system is inaccessible when unattended.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon - True - '{0}' -match '1|2' +Value: 0 + 0 + DisableCAD + Dword + + + <VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked. Configuring a system to lock when a smart card is removed will ensure the system is inaccessible when unattended.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon + True + '{0}' -match '1|2' If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3101,19 +3103,19 @@ Value Name: SCRemoveOption Value Type: REG_SZ Value: 1 (Lock Workstation) or 2 (Force Logoff) -If configuring this on servers causes issues such as terminating users' remote sessions and the site has a policy in place that any other sessions on the servers such as administrative console logons, are manually locked or logged off when unattended or not in use, this would be acceptable. This must be documented with the ISSO. - - SCRemoveOption - String - - - <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will negotiate SMB packet signing as requested by the client.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters - False - +If configuring this on servers causes issues such as terminating users' remote sessions and the site has a policy in place that any other sessions on the servers such as administrative console logons, are manually locked or logged off when unattended or not in use, this would be acceptable. This must be documented with the ISSO. + + SCRemoveOption + String + + + <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will negotiate SMB packet signing as requested by the client.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3122,19 +3124,19 @@ Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: EnableSecuritySignature Value Type: REG_DWORD -Value: 1 - 1 - EnableSecuritySignature - Dword - - - <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters - False - +Value: 1 + 1 + EnableSecuritySignature + Dword + + + <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3145,19 +3147,19 @@ Value Name: SealSecureChannel Value Type: REG_DWORD Value: 1 -If the value for "Domain Member: Digitally encrypt or sign secure channel data (always)" is set to "Enabled", this can be NA (see V-6831). - 1 - SealSecureChannel - Dword - - - <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked. If this policy is enabled, outgoing secure channel traffic will be signed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters - False - +If the value for "Domain Member: Digitally encrypt or sign secure channel data (always)" is set to "Enabled", this can be NA (see V-6831). + 1 + SealSecureChannel + Dword + + + <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked. If this policy is enabled, outgoing secure channel traffic will be signed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3168,19 +3170,19 @@ Value Name: SignSecureChannel Value Type: REG_DWORD Value: 1 -If the value for "Domain Member: Digitally encrypt or sign secure channel data (always)" is set to "Enabled", this can be NA (see V-6831). - 1 - SignSecureChannel - Dword - - - <VulnDiscussion>Computer account passwords are changed automatically on a regular basis. Disabling automatic password changes can make the system more vulnerable to malicious access. Frequent password changes can be a significant safeguard for your system. A new password for the computer account will be generated every 30 days.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters - False - +If the value for "Domain Member: Digitally encrypt or sign secure channel data (always)" is set to "Enabled", this can be NA (see V-6831). + 1 + SignSecureChannel + Dword + + + <VulnDiscussion>Computer account passwords are changed automatically on a regular basis. Disabling automatic password changes can make the system more vulnerable to malicious access. Frequent password changes can be a significant safeguard for your system. A new password for the computer account will be generated every 30 days.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3189,19 +3191,19 @@ Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: DisablePasswordChange Value Type: REG_DWORD -Value: 0 - 0 - DisablePasswordChange - Dword - - - <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. If this policy is enabled, the SMB client will request packet signing when communicating with an SMB server that is enabled or required to perform SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters - False - +Value: 0 + 0 + DisablePasswordChange + Dword + + + <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. If this policy is enabled, the SMB client will request packet signing when communicating with an SMB server that is enabled or required to perform SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3210,19 +3212,19 @@ Registry Path: \System\CurrentControlSet\Services\LanmanWorkstation\Parameters\ Value Name: EnableSecuritySignature Value Type: REG_DWORD -Value: 1 - 1 - EnableSecuritySignature - Dword - - - <VulnDiscussion>Removable hard drives, if they are not properly configured, can be formatted and ejected by users who are not members of the Administrators Group. Formatting and ejecting removable NTFS media must only be done by administrators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon - False - +Value: 1 + 1 + EnableSecuritySignature + Dword + + + <VulnDiscussion>Removable hard drives, if they are not properly configured, can be formatted and ejected by users who are not members of the Administrators Group. Formatting and ejecting removable NTFS media must only be done by administrators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3231,19 +3233,19 @@ Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value Name: AllocateDASD Value Type: REG_SZ -Value: 0 - 0 - AllocateDASD - String - - - <VulnDiscussion>Creating strong passwords that can be remembered by users requires some thought. By giving the user advance warning, the user has time to construct a sufficiently strong password. This setting configures the system to display a warning to users telling them how many days are left before their password expires.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon - True - '{0}' -ge '14' +Value: 0 + 0 + AllocateDASD + String + + + <VulnDiscussion>Creating strong passwords that can be remembered by users requires some thought. By giving the user advance warning, the user has time to construct a sufficiently strong password. This setting configures the system to display a warning to users telling them how many days are left before their password expires.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon + True + '{0}' -ge '14' If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3252,19 +3254,19 @@ Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value Name: PasswordExpiryWarning Value Type: REG_DWORD -Value: 14 (or greater) - - PasswordExpiryWarning - Dword - - - <VulnDiscussion>Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default DACL that specifies who can access the objects with what permissions. If this policy is enabled, the default DACL is stronger, allowing nonadministrative users to read shared objects, but not modify shared objects that they did not create.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager - False - +Value: 14 (or greater) + + PasswordExpiryWarning + Dword + + + <VulnDiscussion>Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default DACL that specifies who can access the objects with what permissions. If this policy is enabled, the default DACL is stronger, allowing nonadministrative users to read shared objects, but not modify shared objects that they did not create.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3273,19 +3275,19 @@ Registry Path: \System\CurrentControlSet\Control\Session Manager\ Value Name: ProtectionMode Value Type: REG_DWORD -Value: 1 - 1 - ProtectionMode - Dword - - - <VulnDiscussion>Open sessions can increase the avenues of attack on a system. This setting is used to control when a computer disconnects an inactive SMB session. If client activity resumes, the session is automatically reestablished. This protects critical and sensitive network data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters - True - '{0}' -le '15' +Value: 1 + 1 + ProtectionMode + Dword + + + <VulnDiscussion>Open sessions can increase the avenues of attack on a system. This setting is used to control when a computer disconnects an inactive SMB session. If client activity resumes, the session is automatically reestablished. This protects critical and sensitive network data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + True + '{0}' -le '15' If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3294,19 +3296,19 @@ Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: autodisconnect Value Type: REG_DWORD -Value: 0x0000000f (15) (or less) - - autodisconnect - Dword - - - <VulnDiscussion>Allowing Autoplay to execute may introduce malicious code to a system. Autoplay begins reading from a drive as soon media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. By default, Autoplay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive) and on network drives. Enabling this policy disables Autoplay on all drives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer - False - +Value: 0x0000000f (15) (or less) + + autodisconnect + Dword + + + <VulnDiscussion>Allowing Autoplay to execute may introduce malicious code to a system. Autoplay begins reading from a drive as soon media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. By default, Autoplay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive) and on network drives. Enabling this policy disables Autoplay on all drives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3315,19 +3317,19 @@ Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ Value Name: NoDriveTypeAutoRun Type: REG_DWORD -Value: 0x000000ff (255) - 255 - NoDriveTypeAutoRun - Dword - - - <VulnDiscussion>Named pipes that can be accessed anonymously provide the potential for gaining unauthorized system access. Pipes are internal system communications processes. They are identified internally by ID numbers that vary between systems. To make access to these processes easier, these pipes are given names that do not vary between systems. This setting controls which of these pipes anonymous users may access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - True - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters - False - +Value: 0x000000ff (255) + 255 + NoDriveTypeAutoRun + Dword + + + <VulnDiscussion>Named pipes that can be accessed anonymously provide the potential for gaining unauthorized system access. Pipes are internal system communications processes. They are identified internally by ID numbers that vary between systems. To make access to these processes easier, these pipes are given names that do not vary between systems. This setting controls which of these pipes anonymous users may access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + True + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3338,20 +3340,20 @@ Value Name: NullSessionPipes Value Type: REG_MULTI_SZ Value: (blank) -Legitimate applications may add entries to this registry value. If an application requires these entries to function properly and is documented with the ISSO, this would not be a finding. Documentation must contain supporting information from the vendor's instructions. - - - NullSessionPipes - MultiString - - - <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Some processes may require remote access to the registry. This setting controls which registry paths are accessible from a remote computer. These registry paths must be limited, as they could give unauthorized individuals access to the registry.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths - False - +Legitimate applications may add entries to this registry value. If an application requires these entries to function properly and is documented with the ISSO, this would not be a finding. Documentation must contain supporting information from the vendor's instructions. + + + NullSessionPipes + MultiString + + + <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Some processes may require remote access to the registry. This setting controls which registry paths are accessible from a remote computer. These registry paths must be limited, as they could give unauthorized individuals access to the registry.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3366,19 +3368,19 @@ System\CurrentControlSet\Control\ProductOptions System\CurrentControlSet\Control\Server Applications Software\Microsoft\Windows NT\CurrentVersion -Legitimate applications may add entries to this registry value. If an application requires these entries to function properly and is documented with the ISSO, this would not be a finding. Documentation must contain supporting information from the vendor's instructions. - System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion - Machine - MultiString - - - <VulnDiscussion>Anonymous access to network shares provides the potential for gaining unauthorized system access by network users. This could lead to the exposure or corruption of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - True - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters - False - +Legitimate applications may add entries to this registry value. If an application requires these entries to function properly and is documented with the ISSO, this would not be a finding. Documentation must contain supporting information from the vendor's instructions. + System\CurrentControlSet\Control\ProductOptions;System\CurrentControlSet\Control\Server Applications;Software\Microsoft\Windows NT\CurrentVersion + Machine + MultiString + + + <VulnDiscussion>Anonymous access to network shares provides the potential for gaining unauthorized system access by network users. This could lead to the exposure or corruption of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + True + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters + False + If the following registry value does not exist, this is not a finding: If the following registry value does exist and is not configured as specified, this is a finding: @@ -3389,20 +3391,20 @@ Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: NullSessionShares Value Type: REG_MULTI_SZ -Value: (Blank) - - - NullSessionShares - MultiString - - - <VulnDiscussion>Remote assistance allows another user to view or take control of the local session of a user. Solicited assistance is help that is specifically requested by the local user. This may allow unauthorized parties access to the resources on the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services - False - +Value: (Blank) + + + NullSessionShares + MultiString + + + <VulnDiscussion>Remote assistance allows another user to view or take control of the local session of a user. Solicited assistance is help that is specifically requested by the local user. This may allow unauthorized parties access to the resources on the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3411,19 +3413,19 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fAllowToGetHelp Type: REG_DWORD -Value: 0 - 0 - fAllowToGetHelp - Dword - - - <VulnDiscussion>An account without a password can allow unauthorized access to a system as only the username would be required. Password policies should prevent accounts with blank passwords from existing on a system. However, if a local account with a blank password did exist, enabling this setting will prevent network access, limiting the account to local console logon only.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa - False - +Value: 0 + 0 + fAllowToGetHelp + Dword + + + <VulnDiscussion>An account without a password can allow unauthorized access to a system as only the username would be required. Password policies should prevent accounts with blank passwords from existing on a system. However, if a local account with a blank password did exist, enabling this setting will prevent network access, limiting the account to local console logon only.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3432,19 +3434,19 @@ Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: LimitBlankPasswordUse Value Type: REG_DWORD -Value: 1 - 1 - LimitBlankPasswordUse - Dword - - - <VulnDiscussion>Computer account passwords are changed automatically on a regular basis. This setting controls the maximum password age that a machine account may have. This setting must be set to no more than 30 days, ensuring the machine changes its password monthly.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters - True - '{0}' -le '30' -and '{0}' -gt '0' +Value: 1 + 1 + LimitBlankPasswordUse + Dword + + + <VulnDiscussion>Computer account passwords are changed automatically on a regular basis. This setting controls the maximum password age that a machine account may have. This setting must be set to no more than 30 days, ensuring the machine changes its password monthly.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters + True + '{0}' -le '30' -and '{0}' -gt '0' If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3453,19 +3455,19 @@ Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: MaximumPasswordAge Value Type: REG_DWORD -Value: 30 (or less, but not 0) - - MaximumPasswordAge - Dword - - - <VulnDiscussion>A computer connecting to a domain controller will establish a secure channel. Requiring strong session keys enforces 128-bit encryption between systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters - False - +Value: 30 (or less, but not 0) + + MaximumPasswordAge + Dword + + + <VulnDiscussion>A computer connecting to a domain controller will establish a secure channel. Requiring strong session keys enforces 128-bit encryption between systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3476,40 +3478,19 @@ Value Name: RequireStrongKey Value Type: REG_DWORD Value: 1 -This setting may prevent a system from being joined to a domain if not configured consistently between systems. - 1 - RequireStrongKey - Dword - - - <VulnDiscussion>This setting controls the storage of passwords and credentials for network authentication on the local system. Such credentials must not be stored on the local machine, as that may lead to account compromise.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa - False - - If the following registry value does not exist or is not configured as specified, this is a finding: - -Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \System\CurrentControlSet\Control\Lsa\ - -Value Name: DisableDomainCreds - -Value Type: REG_DWORD -Value: 1 - 1 - DisableDomainCreds - Dword - - - <VulnDiscussion>Access by anonymous users must be restricted. If this setting is enabled, then anonymous users have the same rights and permissions as the built-in Everyone group. Anonymous users must not have these permissions or rights.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa - False - +This setting may prevent a system from being joined to a domain if not configured consistently between systems. + 1 + RequireStrongKey + Dword + + + <VulnDiscussion>Access by anonymous users must be restricted. If this setting is enabled, then anonymous users have the same rights and permissions as the built-in Everyone group. Anonymous users must not have these permissions or rights.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3518,19 +3499,19 @@ Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: EveryoneIncludesAnonymous Value Type: REG_DWORD -Value: 0 - 0 - EveryoneIncludesAnonymous - Dword - - - <VulnDiscussion>Windows includes two network-sharing security models - Classic and Guest only. With the Classic model, local accounts must be password protected; otherwise, anyone can use guest user accounts to access shared system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa - False - +Value: 0 + 0 + EveryoneIncludesAnonymous + Dword + + + <VulnDiscussion>Windows includes two network-sharing security models - Classic and Guest only. With the Classic model, local accounts must be password protected; otherwise, anyone can use guest user accounts to access shared system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3539,19 +3520,19 @@ Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: ForceGuest Value Type: REG_DWORD -Value: 0 - 0 - ForceGuest - Dword - - - <VulnDiscussion>The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords. This setting controls whether or not a LAN Manager hash of the password is stored in the SAM the next time the password is changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa - False - +Value: 0 + 0 + ForceGuest + Dword + + + <VulnDiscussion>The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords. This setting controls whether or not a LAN Manager hash of the password is stored in the SAM the next time the password is changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3560,19 +3541,19 @@ Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: NoLMHash Value Type: REG_DWORD -Value: 1 - 1 - NoLMHash - Dword - - - <VulnDiscussion>This setting controls the signing requirements for LDAP clients. This setting must be set to Negotiate signing or Require signing, depending on the environment and type of LDAP server in use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LDAP - False - +Value: 1 + 1 + NoLMHash + Dword + + + <VulnDiscussion>This setting controls the signing requirements for LDAP clients. This setting must be set to Negotiate signing or Require signing, depending on the environment and type of LDAP server in use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LDAP + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3581,19 +3562,19 @@ Registry Path: \System\CurrentControlSet\Services\LDAP\ Value Name: LDAPClientIntegrity Value Type: REG_DWORD -Value: 1 - 1 - LDAPClientIntegrity - Dword - - - <VulnDiscussion>Microsoft has implemented a variety of security support providers for use with RPC sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0 - False - +Value: 1 + 1 + LDAPClientIntegrity + Dword + + + <VulnDiscussion>Microsoft has implemented a variety of security support providers for use with RPC sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0 + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3602,19 +3583,19 @@ Registry Path: \System\CurrentControlSet\Control\Lsa\MSV1_0\ Value Name: NTLMMinClientSec Value Type: REG_DWORD -Value: 0x20080000 (537395200) - 537395200 - NTLMMinClientSec - Dword - - - <VulnDiscussion>This setting ensures that the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing. FIPS-compliant algorithms meet specific standards established by the U.S. Government and must be the algorithms used for all OS encryption functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy - False - +Value: 0x20080000 (537395200) + 537395200 + NTLMMinClientSec + Dword + + + <VulnDiscussion>This setting ensures that the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing. FIPS-compliant algorithms meet specific standards established by the U.S. Government and must be the algorithms used for all OS encryption functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3625,19 +3606,19 @@ Value Name: Enabled Value Type: REG_DWORD Value: 1 -Warning: Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms. Both the browser and web server must be configured to use TLS, or the browser will not be able to connect to a secure site. - 1 - Enabled - Dword - - - <VulnDiscussion>This setting controls the behavior of non-Windows subsystems when dealing with the case of arguments or commands. Case sensitivity could lead to the access of files or commands that must be restricted. To prevent this from happening, case insensitivity restrictions must be required.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Kernel - False - +Warning: Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms. Both the browser and web server must be configured to use TLS, or the browser will not be able to connect to a secure site. + 1 + Enabled + Dword + + + <VulnDiscussion>This setting controls the behavior of non-Windows subsystems when dealing with the case of arguments or commands. Case sensitivity could lead to the access of files or commands that must be restricted. To prevent this from happening, case insensitivity restrictions must be required.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Kernel + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3646,19 +3627,19 @@ Registry Path: \System\CurrentControlSet\Control\Session Manager\Kernel\ Value Name: ObCaseInsensitive Value Type: REG_DWORD -Value: 1 - 1 - ObCaseInsensitive - Dword - - - <VulnDiscussion>Allowing multiple Remote Desktop Services sessions could consume resources. There is also potential to make a secondary connection to a system with compromised credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLO-1, ECLO-2</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services - False - +Value: 1 + 1 + ObCaseInsensitive + Dword + + + <VulnDiscussion>Allowing multiple Remote Desktop Services sessions could consume resources. There is also potential to make a secondary connection to a system with compromised credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLO-1, ECLO-2</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3667,19 +3648,19 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fSingleSessionPerUser Type: REG_DWORD -Value: 1 - 1 - fSingleSessionPerUser - Dword - - - <VulnDiscussion>This setting controls the ability of users to supply passwords automatically as part of their remote desktop connection. Disabling this setting would allow anyone to use the stored credentials in a connection item to connect to the terminal server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services - False - +Value: 1 + 1 + fSingleSessionPerUser + Dword + + + <VulnDiscussion>This setting controls the ability of users to supply passwords automatically as part of their remote desktop connection. Disabling this setting would allow anyone to use the stored credentials in a connection item to connect to the terminal server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3688,19 +3669,19 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fPromptForPassword Type: REG_DWORD -Value: 1 - 1 - fPromptForPassword - Dword - - - <VulnDiscussion>Remote connections must be encrypted to prevent interception of data or sensitive information. Selecting "High Level" will ensure encryption of Remote Desktop Services sessions in both directions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services - False - +Value: 1 + 1 + fPromptForPassword + Dword + + + <VulnDiscussion>Remote connections must be encrypted to prevent interception of data or sensitive information. Selecting "High Level" will ensure encryption of Remote Desktop Services sessions in both directions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3709,19 +3690,19 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: MinEncryptionLevel Type: REG_DWORD -Value: 3 - 3 - MinEncryptionLevel - Dword - - - <VulnDiscussion>If a communal temporary folder is used for remote desktop sessions, it might be possible for users to access other users' temporary folders. If this setting is enabled, only one temporary folder is used for all remote desktop sessions. Per session temporary folders must be established.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services - False - +Value: 3 + 3 + MinEncryptionLevel + Dword + + + <VulnDiscussion>If a communal temporary folder is used for remote desktop sessions, it might be possible for users to access other users' temporary folders. If this setting is enabled, only one temporary folder is used for all remote desktop sessions. Per session temporary folders must be established.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3730,19 +3711,19 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: PerSessionTempDir Type: REG_DWORD -Value: 1 - 1 - PerSessionTempDir - Dword - - - <VulnDiscussion>Remote desktop session temporary folders must always be deleted after a session is over to prevent hard disk clutter and potential leakage of information. This setting controls the deletion of the temporary folders when the session is terminated.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services - False - +Value: 1 + 1 + PerSessionTempDir + Dword + + + <VulnDiscussion>Remote desktop session temporary folders must always be deleted after a session is over to prevent hard disk clutter and potential leakage of information. This setting controls the deletion of the temporary folders when the session is terminated.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3751,19 +3732,19 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: DeleteTempDirsOnExit Type: REG_DWORD -Value: 1 - 1 - DeleteTempDirsOnExit - Dword - - - <VulnDiscussion>If this setting is enabled, then Group Policy settings are not refreshed while a user is currently logged on. This could lead to instances when a user does not have the latest changes to a policy applied and is therefore operating in an insecure context.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\system - False - +Value: 1 + 1 + DeleteTempDirsOnExit + Dword + + + <VulnDiscussion>If this setting is enabled, then Group Policy settings are not refreshed while a user is currently logged on. This could lead to instances when a user does not have the latest changes to a policy applied and is therefore operating in an insecure context.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\system + False + Review the registry. If the following registry value does not exist, this is not a finding (this is the expected result from configuring the policy as outlined in the Fix section.): If the following registry value exists but is not configured as specified, this is a finding: @@ -3774,19 +3755,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\system\ Value Name: DisableBkGndGroupPolicy Type: REG_DWORD -Value: 0 - 0 - DisableBkGndGroupPolicy - Dword - - - <VulnDiscussion>Remote assistance allows another user to view or take control of the local session of a user. Unsolicited remote assistance is help that is offered by the remote user. This may allow unauthorized parties access to the resources on the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services - False - +Value: 0 + 0 + DisableBkGndGroupPolicy + Dword + + + <VulnDiscussion>Remote assistance allows another user to view or take control of the local session of a user. Unsolicited remote assistance is help that is offered by the remote user. This may allow unauthorized parties access to the resources on the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3795,19 +3776,19 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fAllowUnsolicited Type: REG_DWORD -Value: 0 - 0 - fAllowUnsolicited - Dword - - - <VulnDiscussion>The default search behavior, when an application calls a function in a Dynamic Link Library (DLL), is to search the current directory, followed by the directories contained in the system's path environment variable. An unauthorized DLL, inserted into an application's working directory, could allow malicious code to be run on the system. Setting this policy value forces the system to search the %Systemroot% for the DLL before searching the current directory or the rest of the path.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager - False - +Value: 0 + 0 + fAllowUnsolicited + Dword + + + <VulnDiscussion>The default search behavior, when an application calls a function in a Dynamic Link Library (DLL), is to search the current directory, followed by the directories contained in the system's path environment variable. An unauthorized DLL, inserted into an application's working directory, could allow malicious code to be run on the system. Setting this policy value forces the system to search the %Systemroot% for the DLL before searching the current directory or the rest of the path.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3816,19 +3797,19 @@ Registry Path: \System\CurrentControlSet\Control\Session Manager\ Value Name: SafeDllSearchMode Value Type: REG_DWORD -Value: 1 - 1 - SafeDllSearchMode - Dword - - - <VulnDiscussion>Uncontrolled system updates can introduce issues to a system. The automatic check for updates performed by Windows Media Player must be disabled to ensure a constant platform and to prevent the introduction of unknown\untested software on the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsMediaPlayer - False - +Value: 1 + 1 + SafeDllSearchMode + Dword + + + <VulnDiscussion>Uncontrolled system updates can introduce issues to a system. The automatic check for updates performed by Windows Media Player must be disabled to ensure a constant platform and to prevent the introduction of unknown\untested software on the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsMediaPlayer + False + Windows Media Player is not installed by default. If it is not installed, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -3839,19 +3820,19 @@ Registry Path: \Software\Policies\Microsoft\WindowsMediaPlayer\ Value Name: DisableAutoupdate Type: REG_DWORD -Value: 1 - 1 - DisableAutoupdate - Dword - - - <VulnDiscussion>The Windows Media Player uses software components, referred to as Codecs, to play back media files. By default, when an unknown file type is opened with the Media Player, it will search the Internet for the appropriate Codec and automatically download it. To ensure platform consistency and to protect against new vulnerabilities associated with media types, all Codecs must be installed by the System Administrator.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_CURRENT_USER\Software\Policies\Microsoft\WindowsMediaPlayer - False - +Value: 1 + 1 + DisableAutoupdate + Dword + + + <VulnDiscussion>The Windows Media Player uses software components, referred to as Codecs, to play back media files. By default, when an unknown file type is opened with the Media Player, it will search the Internet for the appropriate Codec and automatically download it. To ensure platform consistency and to protect against new vulnerabilities associated with media types, all Codecs must be installed by the System Administrator.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_CURRENT_USER\Software\Policies\Microsoft\WindowsMediaPlayer + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER @@ -3860,19 +3841,19 @@ Registry Path: \Software\Policies\Microsoft\WindowsMediaPlayer\ Value Name: PreventCodecDownload Type: REG_DWORD -Value: 1 - 1 - PreventCodecDownload - Dword - - - <VulnDiscussion>Microsoft has implemented a variety of security support providers for use with RPC sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0 - False - +Value: 1 + 1 + PreventCodecDownload + Dword + + + <VulnDiscussion>Microsoft has implemented a variety of security support providers for use with RPC sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0 + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3881,19 +3862,19 @@ Registry Path: \System\CurrentControlSet\Control\Lsa\MSV1_0\ Value Name: NTLMMinServerSec Value Type: REG_DWORD -Value: 0x20080000 (537395200) - 537395200 - NTLMMinServerSec - Dword - - - <VulnDiscussion>When the audit log reaches a given percent full, an audit event is written to the security log. It is recorded as a successful audit event under the category of System. This option may be especially useful if the audit logs are set to be cleared manually.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Security - True - '{0}' -le '90' +Value: 0x20080000 (537395200) + 537395200 + NTLMMinServerSec + Dword + + + <VulnDiscussion>When the audit log reaches a given percent full, an audit event is written to the security log. It is recorded as a successful audit event under the category of System. This option may be especially useful if the audit logs are set to be cleared manually.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Security + True + '{0}' -le '90' If the system is configured to write to an audit server, or is configured to automatically archive full logs, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -3904,19 +3885,19 @@ Registry Path: \System\CurrentControlSet\Services\Eventlog\Security\ Value Name: WarningLevel Value Type: REG_DWORD -Value: 90 (or less) - - WarningLevel - Dword - - - <VulnDiscussion>Configuring the system to disable IP source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters - False - +Value: 90 (or less) + + WarningLevel + Dword + + + <VulnDiscussion>Configuring the system to disable IP source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3925,19 +3906,19 @@ Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: DisableIPSourceRouting Value Type: REG_DWORD -Value: 2 - 2 - DisableIPSourceRouting - Dword - - - <VulnDiscussion>Allowing ICMP redirect of routes can lead to traffic not being routed properly. When disabled, this forces ICMP to be routed via shortest path first.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters - False - +Value: 2 + 2 + DisableIPSourceRouting + Dword + + + <VulnDiscussion>Allowing ICMP redirect of routes can lead to traffic not being routed properly. When disabled, this forces ICMP to be routed via shortest path first.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3946,19 +3927,19 @@ Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: EnableICMPRedirect Value Type: REG_DWORD -Value: 0 - 0 - EnableICMPRedirect - Dword - - - <VulnDiscussion>The Internet Router Discovery Protocol (IRDP) is used to detect and configure default gateway addresses on the computer. If a router is impersonated on a network, traffic could be routed through the compromised system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters - False - +Value: 0 + 0 + EnableICMPRedirect + Dword + + + <VulnDiscussion>The Internet Router Discovery Protocol (IRDP) is used to detect and configure default gateway addresses on the computer. If a router is impersonated on a network, traffic could be routed through the compromised system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3967,19 +3948,19 @@ Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: PerformRouterDiscovery Value Type: REG_DWORD -Value: 0 - 0 - PerformRouterDiscovery - Dword - - - <VulnDiscussion>This setting controls how often TCP sends a keep-alive packet in attempting to verify that an idle connection is still intact. A higher value could allow an attacker to cause a denial of service with numerous connections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters - True - '{0}' -le '300000' +Value: 0 + 0 + PerformRouterDiscovery + Dword + + + <VulnDiscussion>This setting controls how often TCP sends a keep-alive packet in attempting to verify that an idle connection is still intact. A higher value could allow an attacker to cause a denial of service with numerous connections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters + True + '{0}' -le '300000' If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -3988,19 +3969,19 @@ Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: KeepAliveTime Value Type: REG_DWORD -Value: 300000 (or less) - - KeepAliveTime - Dword - - - <VulnDiscussion>Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the servers WINS resolution capability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netbt\Parameters - False - +Value: 300000 (or less) + + KeepAliveTime + Dword + + + <VulnDiscussion>Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the servers WINS resolution capability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netbt\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4009,19 +3990,19 @@ Registry Path: \SYSTEM\CurrentControlSet\Services\Netbt\Parameters\ Value Name: NoNameReleaseOnDemand Value Type: REG_DWORD -Value: 1 - 1 - NoNameReleaseOnDemand - Dword - - - <VulnDiscussion>In a SYN flood attack, the attacker sends a continuous stream of SYN packets to a server, and the server leaves the half-open connections open until it is overwhelmed and is no longer able to respond to legitimate requests.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters - True - '{0}' -le '3' +Value: 1 + 1 + NoNameReleaseOnDemand + Dword + + + <VulnDiscussion>In a SYN flood attack, the attacker sends a continuous stream of SYN packets to a server, and the server leaves the half-open connections open until it is overwhelmed and is no longer able to respond to legitimate requests.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters + True + '{0}' -le '3' If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4030,19 +4011,19 @@ Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: TcpMaxDataRetransmissions Value Type: REG_DWORD -Value: 3 (or less) - - TcpMaxDataRetransmissions - Dword - - - <VulnDiscussion>Allowing more than several seconds makes the computer vulnerable to a potential attack from someone walking up to the console to attempt to log on to the system before the lock takes effect.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon - True - '{0}' -le '5' +Value: 3 (or less) + + TcpMaxDataRetransmissions + Dword + + + <VulnDiscussion>Allowing more than several seconds makes the computer vulnerable to a potential attack from someone walking up to the console to attempt to log on to the system before the lock takes effect.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon + True + '{0}' -le '5' If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4051,19 +4032,19 @@ Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value Name: ScreenSaverGracePeriod Value Type: REG_SZ -Value: 5 (or less) - - ScreenSaverGracePeriod - String - - - <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Some processes may require remote access to the registry. This setting controls which registry paths and sub-paths are accessible from a remote computer. These registry paths must be limited, as they could give unauthorized individuals access to the registry.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths - False - +Value: 5 (or less) + + ScreenSaverGracePeriod + String + + + <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Some processes may require remote access to the registry. This setting controls which registry paths and sub-paths are accessible from a remote computer. These registry paths must be limited, as they could give unauthorized individuals access to the registry.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4086,19 +4067,19 @@ System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration System\CurrentControlSet\Services\Eventlog System\CurrentControlSet\Services\Sysmonlog -Legitimate applications may add entries to this registry value. If an application requires these entries to function properly and is documented with the ISSO, this would not be a finding. Documentation must contain supporting information from the vendor's instructions. - Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Perflib;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;System\CurrentControlSet\Services\Eventlog;System\CurrentControlSet\Services\Sysmonlog - Machine - MultiString - - - <VulnDiscussion>The POSIX subsystem is an Institute of Electrical and Electronic Engineers (IEEE) standard that defines a set of operating system services. The POSIX Subsystem is required if the server supports applications that use that subsystem. The subsystem introduces a security risk relating to processes that can potentially persist across logins. That is, if a user starts a process and then logs out, there is a potential that the next user who logs in to the system could access the previous users process. This is dangerous because the process started by the first user may retain that users system privileges, and anything the second user does with that process will be performed with the privileges of the first user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools>HK</ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - True - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Subsystems - False - +Legitimate applications may add entries to this registry value. If an application requires these entries to function properly and is documented with the ISSO, this would not be a finding. Documentation must contain supporting information from the vendor's instructions. + Software\Microsoft\OLAP Server;Software\Microsoft\Windows NT\CurrentVersion\Perflib;Software\Microsoft\Windows NT\CurrentVersion\Print;Software\Microsoft\Windows NT\CurrentVersion\Windows;System\CurrentControlSet\Control\ContentIndex;System\CurrentControlSet\Control\Print\Printers;System\CurrentControlSet\Control\Terminal Server;System\CurrentControlSet\Control\Terminal Server\UserConfig;System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration;System\CurrentControlSet\Services\Eventlog;System\CurrentControlSet\Services\Sysmonlog + Machine + MultiString + + + <VulnDiscussion>The POSIX subsystem is an Institute of Electrical and Electronic Engineers (IEEE) standard that defines a set of operating system services. The POSIX Subsystem is required if the server supports applications that use that subsystem. The subsystem introduces a security risk relating to processes that can potentially persist across logins. That is, if a user starts a process and then logs out, there is a potential that the next user who logs in to the system could access the previous users process. This is dangerous because the process started by the first user may retain that users system privileges, and anything the second user does with that process will be performed with the privileges of the first user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools>HK</ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + True + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Subsystems + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4107,20 +4088,20 @@ Registry Path: \System\CurrentControlSet\Control\Session Manager\Subsystems\ Value Name: Optional Value Type: REG_MULTI_SZ -Value: (Blank) - - - Optional - MultiString - - - <VulnDiscussion>Allowing unsecure RPC communication exposes the system to man-in-the-middle attacks and data disclosure attacks. A man-in-the-middle attack occurs when an intruder captures packets between a client and server and modifies them before allowing the packets to be exchanged. Usually the attacker will modify the information in the packets in an attempt to cause either the client or server to reveal sensitive information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services - False - +Value: (Blank) + + + Optional + MultiString + + + <VulnDiscussion>Allowing unsecure RPC communication exposes the system to man-in-the-middle attacks and data disclosure attacks. A man-in-the-middle attack occurs when an intruder captures packets between a client and server and modifies them before allowing the packets to be exchanged. Usually the attacker will modify the information in the packets in an attempt to cause either the client or server to reveal sensitive information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4129,19 +4110,19 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fEncryptRPCTraffic Type: REG_DWORD -Value: 1 - 1 - fEncryptRPCTraffic - Dword - - - <VulnDiscussion>Enabling this setting and then selecting the "Process even if the Group Policy objects have not changed" option ensures that the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2} - False - +Value: 1 + 1 + fEncryptRPCTraffic + Dword + + + <VulnDiscussion>Enabling this setting and then selecting the "Process even if the Group Policy objects have not changed" option ensures that the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2} + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4150,19 +4131,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F- Value Name: NoGPOListChanges Type: REG_DWORD -Value: 0 - 0 - NoGPOListChanges - Dword - - - <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted and signed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters - False - +Value: 0 + 0 + NoGPOListChanges + Dword + + + <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted and signed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4171,19 +4152,19 @@ Registry Path: \System\CurrentControlSet\Services\Netlogon\Parameters\ Value Name: RequireSignOrSeal Value Type: REG_DWORD -Value: 1 - 1 - RequireSignOrSeal - Dword - - - <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters - False - +Value: 1 + 1 + RequireSignOrSeal + Dword + + + <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4192,19 +4173,19 @@ Registry Path: \System\CurrentControlSet\Services\LanmanWorkstation\Parameters\ Value Name: RequireSecuritySignature Value Type: REG_DWORD -Value: 1 - 1 - RequireSecuritySignature - Dword - - - <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters - False - +Value: 1 + 1 + RequireSecuritySignature + Dword + + + <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4213,19 +4194,19 @@ Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RequireSecuritySignature Value Type: REG_DWORD -Value: 1 - 1 - RequireSecuritySignature - Dword - - - <VulnDiscussion>Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access. This setting restricts access to those defined in "Network access: Named Pipes that can be accessed anonymously" and "Network access: Shares that can be accessed anonymously", both of which must be blank under other requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters - False - +Value: 1 + 1 + RequireSecuritySignature + Dword + + + <VulnDiscussion>Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access. This setting restricts access to those defined in "Network access: Named Pipes that can be accessed anonymously" and "Network access: Shares that can be accessed anonymously", both of which must be blank under other requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4234,19 +4215,19 @@ Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\ Value Name: RestrictNullSessAccess Value Type: REG_DWORD -Value: 1 - 1 - RestrictNullSessAccess - Dword - - - <VulnDiscussion>Displaying the username of the last logged on user provides half of the userid/password equation that an unauthorized person would need to gain access. The username of the last user to log on to a system must not be displayed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System - False - +Value: 1 + 1 + RestrictNullSessAccess + Dword + + + <VulnDiscussion>Displaying the username of the last logged on user provides half of the userid/password equation that an unauthorized person would need to gain access. The username of the last user to log on to a system must not be displayed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4255,20 +4236,20 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: DontDisplayLastUserName Value Type: REG_DWORD -Value: 1 - 1 - DontDisplayLastUserName - Dword - - +Value: 1 + 1 + DontDisplayLastUserName + Dword + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -This setting prevents the system from setting up a default system access control list for certain system objects, which could create a very large number of security events, filling the security log in Windows and making it difficult to identify actual issues.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa - False - +This setting prevents the system from setting up a default system access control list for certain system objects, which could create a very large number of security events, filling the security log in Windows and making it difficult to identify actual issues.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4277,20 +4258,20 @@ Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: AuditBaseObjects Value Type: REG_DWORD -Value: 0 - 0 - AuditBaseObjects - Dword - - +Value: 0 + 0 + AuditBaseObjects + Dword + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -This setting prevents the system from generating audit events for every file backed up or restored, which could fill the security log in Windows, making it difficult to identify actual issues.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa - False - +This setting prevents the system from generating audit events for every file backed up or restored, which could fill the security log in Windows, making it difficult to identify actual issues.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4299,20 +4280,20 @@ Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: FullPrivilegeAuditing Value Type: REG_BINARY -Value: 0 - 0 - FullPrivilegeAuditing - Binary - - +Value: 0 + 0 + FullPrivilegeAuditing + Binary + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -This setting allows administrators to enable more precise auditing capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa - False - +This setting allows administrators to enable more precise auditing capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4321,19 +4302,19 @@ Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: SCENoApplyLegacyAuditPolicy Value Type: REG_DWORD -Value: 1 - 1 - SCENoApplyLegacyAuditPolicy - Dword - - - <VulnDiscussion>IPSec exemption filters allow specific traffic that may be needed by the system for such things as Kerberos authentication. This setting configures Windows for specific IPSec exemptions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\IPSEC - False - +Value: 1 + 1 + SCENoApplyLegacyAuditPolicy + Dword + + + <VulnDiscussion>IPSec exemption filters allow specific traffic that may be needed by the system for such things as Kerberos authentication. This setting configures Windows for specific IPSec exemptions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\IPSEC + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4342,19 +4323,19 @@ Registry Path: \System\CurrentControlSet\Services\IPSEC\ Value Name: NoDefaultExempt Value Type: REG_DWORD -Value: 3 - 3 - NoDefaultExempt - Dword - - - <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the built-in Administrator account so that it runs in Admin Approval Mode.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System - False - +Value: 3 + 3 + NoDefaultExempt + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the built-in Administrator account so that it runs in Admin Approval Mode.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System + False + UAC requirements are NA on Server Core installations. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -4365,19 +4346,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: FilterAdministratorToken Value Type: REG_DWORD -Value: 1 - 1 - FilterAdministratorToken - Dword - - - <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the elevation requirements for logged on administrators to complete a task that requires raised privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System - True - '{0}' -le '4' +Value: 1 + 1 + FilterAdministratorToken + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the elevation requirements for logged on administrators to complete a task that requires raised privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System + True + '{0}' -le '4' UAC requirements are NA on Server Core installations. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -4391,19 +4372,19 @@ Value Type: REG_DWORD Value: 4 (Prompt for consent) 3 (Prompt for credentials) 2 (Prompt for consent on the secure desktop) -1 (Prompt for credentials on the secure desktop) - - ConsentPromptBehaviorAdmin - Dword - - - <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting controls the behavior of elevation when requested by a standard user account.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System - False - +1 (Prompt for credentials on the secure desktop) + + ConsentPromptBehaviorAdmin + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting controls the behavior of elevation when requested by a standard user account.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System + False + UAC requirements are NA on Server Core installations. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -4414,19 +4395,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: ConsentPromptBehaviorUser Value Type: REG_DWORD -Value: 0 - 0 - ConsentPromptBehaviorUser - Dword - - - <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting requires Windows to respond to application installation requests by prompting for credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System - False - +Value: 0 + 0 + ConsentPromptBehaviorUser + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting requires Windows to respond to application installation requests by prompting for credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System + False + UAC requirements are NA on Server Core installations. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -4437,19 +4418,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableInstallerDetection Value Type: REG_DWORD -Value: 1 - 1 - EnableInstallerDetection - Dword - - - <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures Windows to only allow applications installed in a secure location on the file system, such as the Program Files or the Windows\System32 folders, to run with elevated privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System - False - +Value: 1 + 1 + EnableInstallerDetection + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures Windows to only allow applications installed in a secure location on the file system, such as the Program Files or the Windows\System32 folders, to run with elevated privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System + False + UAC requirements are NA on Server Core installations. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -4460,19 +4441,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableSecureUIAPaths Value Type: REG_DWORD -Value: 1 - 1 - EnableSecureUIAPaths - Dword - - - <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting enables UAC.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System - False - +Value: 1 + 1 + EnableSecureUIAPaths + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting enables UAC.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System + False + UAC requirements are NA on Server Core installations. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -4483,19 +4464,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableLUA Value Type: REG_DWORD -Value: 1 - 1 - EnableLUA - Dword - - - <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting ensures that the elevation prompt is only used in secure desktop mode.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System - False - +Value: 1 + 1 + EnableLUA + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting ensures that the elevation prompt is only used in secure desktop mode.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System + False + UAC requirements are NA on Server Core installations. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -4506,19 +4487,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: PromptOnSecureDesktop Value Type: REG_DWORD -Value: 1 - 1 - PromptOnSecureDesktop - Dword - - - <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures non-UAC-compliant applications to run in virtualized file and registry entries in per-user locations, allowing them to run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System - False - +Value: 1 + 1 + PromptOnSecureDesktop + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures non-UAC-compliant applications to run in virtualized file and registry entries in per-user locations, allowing them to run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System + False + UAC requirements are NA on Server Core installations. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -4529,19 +4510,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableVirtualization Value Type: REG_DWORD -Value: 1 - 1 - EnableVirtualization - Dword - - - <VulnDiscussion>Enumeration of administrator accounts when elevating can provide part of the logon information to an unauthorized user. This setting configures the system to always require users to enter in a username and password to elevate a running application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI - False - +Value: 1 + 1 + EnableVirtualization + Dword + + + <VulnDiscussion>Enumeration of administrator accounts when elevating can provide part of the logon information to an unauthorized user. This setting configures the system to always require users to enter in a username and password to elevate a running application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4550,19 +4531,19 @@ Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\ Value Name: EnumerateAdministrators Type: REG_DWORD -Value: 0x00000000 (0) - 0 - EnumerateAdministrators - Dword - - - <VulnDiscussion>Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system. The system must be configured to prevent users from saving passwords in the Remote Desktop Client.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services - False - +Value: 0x00000000 (0) + 0 + EnumerateAdministrators + Dword + + + <VulnDiscussion>Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system. The system must be configured to prevent users from saving passwords in the Remote Desktop Client.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4571,19 +4552,19 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: DisablePasswordSaving Type: REG_DWORD -Value: 1 - 1 - DisablePasswordSaving - Dword - - - <VulnDiscussion>Preventing users from sharing the local drives on their client computers to Remote Session Hosts that they access helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services - False - +Value: 1 + 1 + DisablePasswordSaving + Dword + + + <VulnDiscussion>Preventing users from sharing the local drives on their client computers to Remote Session Hosts that they access helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4592,19 +4573,19 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fDisableCdm Type: REG_DWORD -Value: 1 - 1 - fDisableCdm - Dword - - - <VulnDiscussion>Configuring RPC to restrict unauthenticated RPC clients from connecting to the RPC server will prevent anonymous connections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Rpc - False - +Value: 1 + 1 + fDisableCdm + Dword + + + <VulnDiscussion>Configuring RPC to restrict unauthenticated RPC clients from connecting to the RPC server will prevent anonymous connections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Rpc + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4613,20 +4594,20 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Rpc\ Value Name: RestrictRemoteClients Type: REG_DWORD -Value: 1 - 1 - RestrictRemoteClients - Dword - - +Value: 1 + 1 + RestrictRemoteClients + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents the client computer from printing over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers - False - +This setting prevents the client computer from printing over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4635,20 +4616,20 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Printers\ Value Name: DisableHTTPPrinting Type: REG_DWORD -Value: 1 - 1 - DisableHTTPPrinting - Dword - - +Value: 1 + 1 + DisableHTTPPrinting + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents the computer from downloading print driver packages over HTTP.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers - False - +This setting prevents the computer from downloading print driver packages over HTTP.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4657,20 +4638,20 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Printers\ Value Name: DisableWebPnPDownload Type: REG_DWORD -Value: 1 - 1 - DisableWebPnPDownload - Dword - - +Value: 1 + 1 + DisableWebPnPDownload + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents Windows from searching Windows Update for device drivers when no local drivers for a device are present.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DriverSearching - False - +This setting prevents Windows from searching Windows Update for device drivers when no local drivers for a device are present.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DriverSearching + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4679,19 +4660,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\DriverSearching\ Value Name: DontSearchWindowsUpdate Type: REG_DWORD -Value: 1 - 1 - DontSearchWindowsUpdate - Dword - - - <VulnDiscussion>Preserving zone of origin (internet, intranet, local, restricted) information on file attachments allows Windows to determine risk.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments - False - +Value: 1 + 1 + DontSearchWindowsUpdate + Dword + + + <VulnDiscussion>Preserving zone of origin (internet, intranet, local, restricted) information on file attachments allows Windows to determine risk.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER @@ -4700,19 +4681,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\ Value Name: SaveZoneInformation Type: REG_DWORD -Value: 2 - 2 - SaveZoneInformation - Dword - - - <VulnDiscussion>Preserving zone of origin (internet, intranet, local, restricted) information on file attachments allows Windows to determine risk. This setting prevents users from manually removing zone information from saved file attachments.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments - False - +Value: 2 + 2 + SaveZoneInformation + Dword + + + <VulnDiscussion>Preserving zone of origin (internet, intranet, local, restricted) information on file attachments allows Windows to determine risk. This setting prevents users from manually removing zone information from saved file attachments.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER @@ -4721,19 +4702,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\ Value Name: HideZoneInfoOnProperties Type: REG_DWORD -Value: 1 - 1 - HideZoneInfoOnProperties - Dword - - - <VulnDiscussion>Attaching malicious files is a known avenue of attack. This setting configures the system to notify antivirus programs when a user opens a file attachment.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments - False - +Value: 1 + 1 + HideZoneInfoOnProperties + Dword + + + <VulnDiscussion>Attaching malicious files is a known avenue of attack. This setting configures the system to notify antivirus programs when a user opens a file attachment.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER @@ -4742,19 +4723,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Attachments\ Value Name: ScanWithAntiVirus Type: REG_DWORD -Value: 3 - 3 - ScanWithAntiVirus - Dword - - - <VulnDiscussion>Peer-to-Peer applications can allow unauthorized access to a system and exposure of sensitive data. This setting will turn off the Microsoft Peer-to-Peer Networking Service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Peernet - False - +Value: 3 + 3 + ScanWithAntiVirus + Dword + + + <VulnDiscussion>Peer-to-Peer applications can allow unauthorized access to a system and exposure of sensitive data. This setting will turn off the Microsoft Peer-to-Peer Networking Service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Peernet + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4763,19 +4744,19 @@ Registry Path: \Software\Policies\Microsoft\Peernet\ Value Name: Disabled Type: REG_DWORD -Value: 1 - 1 - Disabled - Dword - - - <VulnDiscussion>A Network Bridge can connect two or more network segments, allowing unauthorized access or exposure of sensitive data. This setting prevents a Network Bridge from being installed and configured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Network Connections - False - +Value: 1 + 1 + Disabled + Dword + + + <VulnDiscussion>A Network Bridge can connect two or more network segments, allowing unauthorized access or exposure of sensitive data. This setting prevents a Network Bridge from being installed and configured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Network Connections + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4784,19 +4765,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\Network Connections\ Value Name: NC_AllowNetBridge_NLA Type: REG_DWORD -Value: 0 - 0 - NC_AllowNetBridge_NLA - Dword - - - <VulnDiscussion>Viewing events is a function of administrators, who must not access the internet with privileged accounts. This setting will disable Events.asp hyperlinks in Event Viewer to prevent links to the internet from within events.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EventViewer - False - +Value: 0 + 0 + NC_AllowNetBridge_NLA + Dword + + + <VulnDiscussion>Viewing events is a function of administrators, who must not access the internet with privileged accounts. This setting will disable Events.asp hyperlinks in Event Viewer to prevent links to the internet from within events.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EventViewer + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4805,20 +4786,20 @@ Registry Path: \Software\Policies\Microsoft\EventViewer\ Value Name: MicrosoftEventVwrDisableLinks Type: REG_DWORD -Value: 1 - 1 - MicrosoftEventVwrDisableLinks - Dword - - +Value: 1 + 1 + MicrosoftEventVwrDisableLinks + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents unhandled file associations from using the Microsoft Web service to find an application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer - False - +This setting prevents unhandled file associations from using the Microsoft Web service to find an application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4827,19 +4808,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoInternetOpenWith Type: REG_DWORD -Value: 1 - 1 - NoInternetOpenWith - Dword - - - <VulnDiscussion>Attachments from RSS feeds may not be secure. This setting will prevent attachments from being downloaded from RSS feeds.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Feeds - False - +Value: 1 + 1 + NoInternetOpenWith + Dword + + + <VulnDiscussion>Attachments from RSS feeds may not be secure. This setting will prevent attachments from being downloaded from RSS feeds.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Feeds + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4848,19 +4829,19 @@ Registry Path: \Software\Policies\Microsoft\Internet Explorer\Feeds\ Value Name: DisableEnclosureDownload Type: REG_DWORD -Value: 1 - 1 - DisableEnclosureDownload - Dword - - - <VulnDiscussion>The shell protocol will limit the set of folders applications can open when run in protected mode. Restricting files an application can open to a limited set of folders increases the security of Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer - False - +Value: 1 + 1 + DisableEnclosureDownload + Dword + + + <VulnDiscussion>The shell protocol will limit the set of folders applications can open when run in protected mode. Restricting files an application can open to a limited set of folders increases the security of Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4869,19 +4850,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: PreXPSP2ShellProtocolBehavior Type: REG_DWORD -Value: 0 - 0 - PreXPSP2ShellProtocolBehavior - Dword - - - <VulnDiscussion>Users must be aware of attempted program installations. This setting ensures users are notified if a web-based program attempts to install software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer - False - +Value: 0 + 0 + PreXPSP2ShellProtocolBehavior + Dword + + + <VulnDiscussion>Users must be aware of attempted program installations. This setting ensures users are notified if a web-based program attempts to install software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4890,19 +4871,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\Installer\ Value Name: SafeForScripting Type: REG_DWORD -Value: 0 - 0 - SafeForScripting - Dword - - - <VulnDiscussion>Installation options for applications are typically controlled by administrators. This setting prevents users from changing installation options that may bypass security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer - False - +Value: 0 + 0 + SafeForScripting + Dword + + + <VulnDiscussion>Installation options for applications are typically controlled by administrators. This setting prevents users from changing installation options that may bypass security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4911,19 +4892,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\Installer\ Value Name: EnableUserControl Type: REG_DWORD -Value: 0 - 0 - EnableUserControl - Dword - - - <VulnDiscussion>Uncontrolled system updates can introduce issues to a system. This setting will prevent users from applying vendor-signed updates (though they may be from a trusted source).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer - False - +Value: 0 + 0 + EnableUserControl + Dword + + + <VulnDiscussion>Uncontrolled system updates can introduce issues to a system. This setting will prevent users from applying vendor-signed updates (though they may be from a trusted source).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -4932,20 +4913,20 @@ Registry Path: \Software\Policies\Microsoft\Windows\Installer\ Value Name: DisableLUAPatching Type: REG_DWORD -Value: 1 - 1 - DisableLUAPatching - Dword - - +Value: 1 + 1 + DisableLUAPatching + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents users from being presented with Privacy and Installation options on first use of Windows Media Player, which could enable some communication with the vendor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsMediaPlayer - False - +This setting prevents users from being presented with Privacy and Installation options on first use of Windows Media Player, which could enable some communication with the vendor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsMediaPlayer + False + Windows Media Player is not installed by default. If it is not installed, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -4956,240 +4937,240 @@ Registry Path: \Software\Policies\Microsoft\WindowsMediaPlayer\ Value Name: GroupPrivacyAcceptance Type: REG_DWORD -Value: 1 - 1 - GroupPrivacyAcceptance - Dword - - - <VulnDiscussion>The Mapper I/O network protocol (LLTDIO) driver allows the discovery of the connected network and allows various options to be enabled. Disabling this helps protect the system from potentially discovering and connecting to unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD - False - - Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ -Type: REG_DWORD -Value Name: AllowLLTDIOOndomain -Value: 0 - 0 - AllowLLTDIOOndomain - Dword - - - <VulnDiscussion>The Mapper I/O network protocol (LLTDIO) driver allows the discovery of the connected network and allows various options to be enabled. Disabling this helps protect the system from potentially discovering and connecting to unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD - False - - Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ -Type: REG_DWORD -Value Name: AllowLLTDIOOnPublicNet -Value: 0 - 0 - AllowLLTDIOOnPublicNet - Dword - - - <VulnDiscussion>The Mapper I/O network protocol (LLTDIO) driver allows the discovery of the connected network and allows various options to be enabled. Disabling this helps protect the system from potentially discovering and connecting to unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD - False - - Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ -Type: REG_DWORD -Value Name: EnableLLTDIO -Value: 0 - 0 - EnableLLTDIO - Dword - - - <VulnDiscussion>The Mapper I/O network protocol (LLTDIO) driver allows the discovery of the connected network and allows various options to be enabled. Disabling this helps protect the system from potentially discovering and connecting to unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD - False - - Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ -Type: REG_DWORD -Value Name: ProhibitLLTDIOOnPrivateNet -Value: 0 - 0 - ProhibitLLTDIOOnPrivateNet - Dword - - - <VulnDiscussion>The Responder network protocol driver allows a computer to be discovered and located on a network. Disabling this helps protect the system from potentially being discovered and connected to by unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD - False - - Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ -Type: REG_DWORD -Value Name: AllowRspndrOndomain -Value: 0 - 0 - AllowRspndrOndomain - Dword - - - <VulnDiscussion>The Responder network protocol driver allows a computer to be discovered and located on a network. Disabling this helps protect the system from potentially being discovered and connected to by unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD - False - - Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ -Type: REG_DWORD -Value Name: AllowRspndrOnPublicNet -Value: 0 - 0 - AllowRspndrOnPublicNet - Dword - - - <VulnDiscussion>The Responder network protocol driver allows a computer to be discovered and located on a network. Disabling this helps protect the system from potentially being discovered and connected to by unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD - False - - Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ -Type: REG_DWORD -Value Name: EnableRspndr -Value: 0 - 0 - EnableRspndr - Dword - - - <VulnDiscussion>The Responder network protocol driver allows a computer to be discovered and located on a network. Disabling this helps protect the system from potentially being discovered and connected to by unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD - False - - Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ -Type: REG_DWORD -Value Name: ProhibitRspndrOnPrivateNet -Value: 0 - 0 - ProhibitRspndrOnPrivateNet - Dword - - - <VulnDiscussion>Windows Connect Now allows the discovery and configuration of devices over wireless. Wireless devices must be managed. If a rogue device is connected to a system, there is potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\Registrars - False - - Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\WCN\Registrars\ -Type: REG_DWORD -Value Name: DisableFlashConfigRegistrar -Value: 0 - 0 - DisableFlashConfigRegistrar - Dword - - - <VulnDiscussion>Windows Connect Now allows the discovery and configuration of devices over wireless. Wireless devices must be managed. If a rogue device is connected to a system, there is potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\Registrars - False - - Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\WCN\Registrars\ -Type: REG_DWORD -Value Name: DisableInBand802DOT11Registrar -Value: 0 - 0 - DisableInBand802DOT11Registrar - Dword - - - <VulnDiscussion>Windows Connect Now allows the discovery and configuration of devices over wireless. Wireless devices must be managed. If a rogue device is connected to a system, there is potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\Registrars - False - - Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\WCN\Registrars\ -Type: REG_DWORD -Value Name: DisableUPnPRegistrar -Value: 0 - 0 - DisableUPnPRegistrar - Dword - - - <VulnDiscussion>Windows Connect Now allows the discovery and configuration of devices over wireless. Wireless devices must be managed. If a rogue device is connected to a system, there is potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\Registrars - False - - Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\WCN\Registrars\ -Type: REG_DWORD -Value Name: DisableWPDRegistrar -Value: 0 - 0 - DisableWPDRegistrar - Dword - - - <VulnDiscussion>Windows Connect Now allows the discovery and configuration of devices over wireless. Wireless devices must be managed. If a rogue device is connected to a system, there is potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\Registrars - False - - Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \Software\Policies\Microsoft\Windows\WCN\Registrars\ -Type: REG_DWORD -Value Name: EnableRegistrars -Value: 0 - 0 - EnableRegistrars - Dword - - - <VulnDiscussion>Windows Connect Now provides wizards for tasks such as "Set up a wireless router or access point" and must not be available to users. Functions such as these may allow unauthorized connections to a system and the potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\UI - False - +Value: 1 + 1 + GroupPrivacyAcceptance + Dword + + + <VulnDiscussion>The Mapper I/O network protocol (LLTDIO) driver allows the discovery of the connected network and allows various options to be enabled. Disabling this helps protect the system from potentially discovering and connecting to unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ +Type: REG_DWORD +Value Name: AllowLLTDIOOndomain +Value: 0 + 0 + AllowLLTDIOOndomain + Dword + + + <VulnDiscussion>The Mapper I/O network protocol (LLTDIO) driver allows the discovery of the connected network and allows various options to be enabled. Disabling this helps protect the system from potentially discovering and connecting to unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ +Type: REG_DWORD +Value Name: AllowLLTDIOOnPublicNet +Value: 0 + 0 + AllowLLTDIOOnPublicNet + Dword + + + <VulnDiscussion>The Mapper I/O network protocol (LLTDIO) driver allows the discovery of the connected network and allows various options to be enabled. Disabling this helps protect the system from potentially discovering and connecting to unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ +Type: REG_DWORD +Value Name: EnableLLTDIO +Value: 0 + 0 + EnableLLTDIO + Dword + + + <VulnDiscussion>The Mapper I/O network protocol (LLTDIO) driver allows the discovery of the connected network and allows various options to be enabled. Disabling this helps protect the system from potentially discovering and connecting to unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ +Type: REG_DWORD +Value Name: ProhibitLLTDIOOnPrivateNet +Value: 0 + 0 + ProhibitLLTDIOOnPrivateNet + Dword + + + <VulnDiscussion>The Responder network protocol driver allows a computer to be discovered and located on a network. Disabling this helps protect the system from potentially being discovered and connected to by unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ +Type: REG_DWORD +Value Name: AllowRspndrOndomain +Value: 0 + 0 + AllowRspndrOndomain + Dword + + + <VulnDiscussion>The Responder network protocol driver allows a computer to be discovered and located on a network. Disabling this helps protect the system from potentially being discovered and connected to by unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ +Type: REG_DWORD +Value Name: AllowRspndrOnPublicNet +Value: 0 + 0 + AllowRspndrOnPublicNet + Dword + + + <VulnDiscussion>The Responder network protocol driver allows a computer to be discovered and located on a network. Disabling this helps protect the system from potentially being discovered and connected to by unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ +Type: REG_DWORD +Value Name: EnableRspndr +Value: 0 + 0 + EnableRspndr + Dword + + + <VulnDiscussion>The Responder network protocol driver allows a computer to be discovered and located on a network. Disabling this helps protect the system from potentially being discovered and connected to by unauthorized devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\LLTD\ +Type: REG_DWORD +Value Name: ProhibitRspndrOnPrivateNet +Value: 0 + 0 + ProhibitRspndrOnPrivateNet + Dword + + + <VulnDiscussion>Windows Connect Now allows the discovery and configuration of devices over wireless. Wireless devices must be managed. If a rogue device is connected to a system, there is potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\Registrars + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\WCN\Registrars\ +Type: REG_DWORD +Value Name: DisableFlashConfigRegistrar +Value: 0 + 0 + DisableFlashConfigRegistrar + Dword + + + <VulnDiscussion>Windows Connect Now allows the discovery and configuration of devices over wireless. Wireless devices must be managed. If a rogue device is connected to a system, there is potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\Registrars + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\WCN\Registrars\ +Type: REG_DWORD +Value Name: DisableInBand802DOT11Registrar +Value: 0 + 0 + DisableInBand802DOT11Registrar + Dword + + + <VulnDiscussion>Windows Connect Now allows the discovery and configuration of devices over wireless. Wireless devices must be managed. If a rogue device is connected to a system, there is potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\Registrars + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\WCN\Registrars\ +Type: REG_DWORD +Value Name: DisableUPnPRegistrar +Value: 0 + 0 + DisableUPnPRegistrar + Dword + + + <VulnDiscussion>Windows Connect Now allows the discovery and configuration of devices over wireless. Wireless devices must be managed. If a rogue device is connected to a system, there is potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\Registrars + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\WCN\Registrars\ +Type: REG_DWORD +Value Name: DisableWPDRegistrar +Value: 0 + 0 + DisableWPDRegistrar + Dword + + + <VulnDiscussion>Windows Connect Now allows the discovery and configuration of devices over wireless. Wireless devices must be managed. If a rogue device is connected to a system, there is potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\Registrars + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \Software\Policies\Microsoft\Windows\WCN\Registrars\ +Type: REG_DWORD +Value Name: EnableRegistrars +Value: 0 + 0 + EnableRegistrars + Dword + + + <VulnDiscussion>Windows Connect Now provides wizards for tasks such as "Set up a wireless router or access point" and must not be available to users. Functions such as these may allow unauthorized connections to a system and the potential for sensitive information to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\UI + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5198,19 +5179,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\WCN\UI\ Value Name: DisableWcnUi Type: REG_DWORD -Value: 1 - 1 - DisableWcnUi - Dword - - - <VulnDiscussion>Remote access to the Plug and Play interface could potentially allow connections by unauthorized devices. This setting configures remote access to the Plug and Play interface and must be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Settings - False - +Value: 1 + 1 + DisableWcnUi + Dword + + + <VulnDiscussion>Remote access to the Plug and Play interface could potentially allow connections by unauthorized devices. This setting configures remote access to the Plug and Play interface and must be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Settings + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5219,19 +5200,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\DeviceInstall\Settings\ Value Name: AllowRemoteRPC Type: REG_DWORD -Value: 0 - 0 - AllowRemoteRPC - Dword - - - <VulnDiscussion>A system restore point allows a rollback if an issue is encountered when a new device driver is installed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Settings - False - +Value: 0 + 0 + AllowRemoteRPC + Dword + + + <VulnDiscussion>A system restore point allows a rollback if an issue is encountered when a new device driver is installed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Settings + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5240,20 +5221,20 @@ Registry Path: \Software\Policies\Microsoft\Windows\DeviceInstall\Settings\ Value Name: DisableSystemRestore Type: REG_DWORD -Value: 0 - 0 - DisableSystemRestore - Dword - - +Value: 0 + 0 + DisableSystemRestore + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents an error report from being sent when a generic device driver is installed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Settings - False - +This setting prevents an error report from being sent when a generic device driver is installed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Settings + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5262,20 +5243,20 @@ Registry Path: \Software\Policies\Microsoft\Windows\DeviceInstall\Settings\ Value Name: DisableSendGenericDriverNotFoundToWER Type: REG_DWORD -Value: 1 - 1 - DisableSendGenericDriverNotFoundToWER - Dword - - +Value: 1 + 1 + DisableSendGenericDriverNotFoundToWER + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents users from being prompted to search Windows Update for device drivers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DriverSearching - False - +This setting prevents users from being prompted to search Windows Update for device drivers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DriverSearching + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5284,20 +5265,20 @@ Registry Path: \Software\Policies\Microsoft\Windows\DriverSearching\ Value Name: DontPromptForWindowsUpdate Type: REG_DWORD -Value: 1 - 1 - DontPromptForWindowsUpdate - Dword - - +Value: 1 + 1 + DontPromptForWindowsUpdate + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents errors in handwriting recognition on tablet PCs from being reported to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\HandwritingErrorReports - False - +This setting prevents errors in handwriting recognition on tablet PCs from being reported to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\HandwritingErrorReports + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5306,19 +5287,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\HandwritingErrorReports\ Value Name: PreventHandwritingErrorReports Type: REG_DWORD -Value: 1 - 1 - PreventHandwritingErrorReports - Dword - - - <VulnDiscussion>Authentication must always be required when accessing a system. This setting ensures the user is prompted for a password on resume from sleep (on battery).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51 - False - +Value: 1 + 1 + PreventHandwritingErrorReports + Dword + + + <VulnDiscussion>Authentication must always be required when accessing a system. This setting ensures the user is prompted for a password on resume from sleep (on battery).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51 + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5327,19 +5308,19 @@ Registry Path: \Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47 Value Name: DCSettingIndex Type: REG_DWORD -Value: 1 - 1 - DCSettingIndex - Dword - - - <VulnDiscussion>Authentication must always be required when accessing a system. This setting ensures the user is prompted for a password on resume from sleep (plugged in).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51 - False - +Value: 1 + 1 + DCSettingIndex + Dword + + + <VulnDiscussion>Authentication must always be required when accessing a system. This setting ensures the user is prompted for a password on resume from sleep (plugged in).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51 + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5348,19 +5329,19 @@ Registry Path: \Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47 Value Name: ACSettingIndex Type: REG_DWORD -Value: 1 - 1 - ACSettingIndex - Dword - - - <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. This setting will turn on session logging for Remote Assistance connections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services - False - +Value: 1 + 1 + ACSettingIndex + Dword + + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. This setting will turn on session logging for Remote Assistance connections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5369,19 +5350,19 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: LoggingEnabled Type: REG_DWORD -Value: 1 - 1 - LoggingEnabled - Dword - - - <VulnDiscussion>Legacy plug-in applications may continue to function when a File Explorer session has become corrupt. Disabling this feature will prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer - False - +Value: 1 + 1 + LoggingEnabled + Dword + + + <VulnDiscussion>Legacy plug-in applications may continue to function when a File Explorer session has become corrupt. Disabling this feature will prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5390,20 +5371,20 @@ Registry Path: \Software\Policies\Microsoft\Windows\Explorer\ Value Name: NoHeapTerminationOnCorruption Type: REG_DWORD -Value: 0 - 0 - NoHeapTerminationOnCorruption - Dword - - +Value: 0 + 0 + NoHeapTerminationOnCorruption + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This check verifies that Windows Media DRM will be prevented from accessing the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WMDRM - False - +This check verifies that Windows Media DRM will be prevented from accessing the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WMDRM + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5412,19 +5393,19 @@ Registry Path: \Software\Policies\Microsoft\WMDRM\ Value Name: DisableOnline Type: REG_DWORD -Value: 1 - 1 - DisableOnline - Dword - - - <VulnDiscussion>Allowing users to share files in their profiles may provide unauthorized access or result in the exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer - False - +Value: 1 + 1 + DisableOnline + Dword + + + <VulnDiscussion>Allowing users to share files in their profiles may provide unauthorized access or result in the exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER @@ -5433,19 +5414,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoInPlaceSharing Type: REG_DWORD -Value: 1 - 1 - NoInPlaceSharing - Dword - - - <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting prevents User Interface Accessibility programs from disabling the secure desktop for elevation prompts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECCD-1, ECCD-2</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System - False - +Value: 1 + 1 + NoInPlaceSharing + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting prevents User Interface Accessibility programs from disabling the secure desktop for elevation prompts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECCD-1, ECCD-2</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System + False + UAC requirements are NA on Server Core installations. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -5456,19 +5437,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: EnableUIADesktopToggle Value Type: REG_DWORD -Value: 0 - 0 - EnableUIADesktopToggle - Dword - - - <VulnDiscussion>Preventing the redirection of Remote Desktop session data to a client computer's COM ports helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services - False - +Value: 0 + 0 + EnableUIADesktopToggle + Dword + + + <VulnDiscussion>Preventing the redirection of Remote Desktop session data to a client computer's COM ports helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5477,19 +5458,19 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fDisableCcm Type: REG_DWORD -Value: 1 - 1 - fDisableCcm - Dword - - - <VulnDiscussion>Preventing the redirection of Remote Desktop session data to a client computer's LPT ports helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services - False - +Value: 1 + 1 + fDisableCcm + Dword + + + <VulnDiscussion>Preventing the redirection of Remote Desktop session data to a client computer's LPT ports helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5498,19 +5479,19 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fDisableLPT Type: REG_DWORD -Value: 1 - 1 - fDisableLPT - Dword - - - <VulnDiscussion>Preventing the redirection of Plug and Play devices in Remote Desktop sessions helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services - False - +Value: 1 + 1 + fDisableLPT + Dword + + + <VulnDiscussion>Preventing the redirection of Plug and Play devices in Remote Desktop sessions helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5519,19 +5500,19 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fDisablePNPRedir Type: REG_DWORD -Value: 1 - 1 - fDisablePNPRedir - Dword - - - <VulnDiscussion>Enabling the redirection of smart card devices allows their use within Remote Desktop sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services - False - +Value: 1 + 1 + fDisablePNPRedir + Dword + + + <VulnDiscussion>Enabling the redirection of smart card devices allows their use within Remote Desktop sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5540,19 +5521,19 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fEnableSmartCard Type: REG_DWORD -Value: 1 - 1 - fEnableSmartCard - Dword - - - <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures whether Windows elevates all applications, or only signed ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System - False - +Value: 1 + 1 + fEnableSmartCard + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures whether Windows elevates all applications, or only signed ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System + False + UAC requirements are NA on Server Core installations. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -5563,20 +5544,20 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: ValidateAdminCodeSignatures Value Type: REG_DWORD -Value: 0 - 0 - ValidateAdminCodeSignatures - Dword - - +Value: 0 + 0 + ValidateAdminCodeSignatures + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting ensures the Windows Customer Experience Improvement Program is disabled so information is not passed to the vendor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows - False - +This setting ensures the Windows Customer Experience Improvement Program is disabled so information is not passed to the vendor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5585,20 +5566,20 @@ Registry Path: \Software\Policies\Microsoft\SQMClient\Windows\ Value Name: CEIPEnable Type: REG_DWORD -Value: 0 - 0 - CEIPEnable - Dword - - +Value: 0 + 0 + CEIPEnable + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting ensures the Windows Help Experience Improvement Program is disabled to prevent information from being passed to the vendor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_CURRENT_USER\Software\Policies\Microsoft\Assistance\Client\1.0 - False - +This setting ensures the Windows Help Experience Improvement Program is disabled to prevent information from being passed to the vendor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_CURRENT_USER\Software\Policies\Microsoft\Assistance\Client\1.0 + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER @@ -5607,20 +5588,20 @@ Registry Path: \Software\Policies\Microsoft\Assistance\Client\1.0\ Value Name: NoImplicitFeedback Type: REG_DWORD -Value: 1 - 1 - NoImplicitFeedback - Dword - - +Value: 1 + 1 + NoImplicitFeedback + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting ensures users cannot provide ratings feedback to Microsoft for Help content.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_CURRENT_USER\Software\Policies\Microsoft\Assistance\Client\1.0 - False - +This setting ensures users cannot provide ratings feedback to Microsoft for Help content.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_CURRENT_USER\Software\Policies\Microsoft\Assistance\Client\1.0 + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER @@ -5629,19 +5610,19 @@ Registry Path: \Software\Policies\Microsoft\Assistance\Client\1.0\ Value Name: NoExplicitFeedback Type: REG_DWORD -Value: 1 - 1 - NoExplicitFeedback - Dword - - - <VulnDiscussion>If a service principle name (SPN) is provided by the client, it is validated against the server's list of SPNs. Implementation may disrupt file and print sharing capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters - False - +Value: 1 + 1 + NoExplicitFeedback + Dword + + + <VulnDiscussion>If a service principle name (SPN) is provided by the client, it is validated against the server's list of SPNs. Implementation may disrupt file and print sharing capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5650,19 +5631,19 @@ Registry Path: \System\CurrentControlSet\Services\LanmanServer\Parameters\ Value Name: SmbServerNameHardeningLevel Type: REG_DWORD -Value: 0 - 0 - SmbServerNameHardeningLevel - Dword - - - <VulnDiscussion>Services using Local System that use Negotiate when reverting to NTLM authentication may gain unauthorized access if allowed to authenticate anonymously vs. using the computer identity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA - False - +Value: 0 + 0 + SmbServerNameHardeningLevel + Dword + + + <VulnDiscussion>Services using Local System that use Negotiate when reverting to NTLM authentication may gain unauthorized access if allowed to authenticate anonymously vs. using the computer identity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5671,19 +5652,19 @@ Registry Path: \System\CurrentControlSet\Control\LSA\ Value Name: UseMachineId Type: REG_DWORD -Value: 1 - 1 - UseMachineId - Dword - - - <VulnDiscussion>NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\MSV1_0 - False - +Value: 1 + 1 + UseMachineId + Dword + + + <VulnDiscussion>NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\MSV1_0 + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5692,19 +5673,19 @@ Registry Path: \System\CurrentControlSet\Control\LSA\MSV1_0\ Value Name: allownullsessionfallback Type: REG_DWORD -Value: 0 - 0 - allownullsessionfallback - Dword - - - <VulnDiscussion>PKU2U is a peer-to-peer authentication protocol. This setting prevents online identities from authenticating to domain-joined systems. Authentication will be centrally managed with Windows user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\pku2u - False - +Value: 0 + 0 + allownullsessionfallback + Dword + + + <VulnDiscussion>PKU2U is a peer-to-peer authentication protocol. This setting prevents online identities from authenticating to domain-joined systems. Authentication will be centrally managed with Windows user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\pku2u + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5713,21 +5694,21 @@ Registry Path: \System\CurrentControlSet\Control\LSA\pku2u\ Value Name: AllowOnlineID Type: REG_DWORD -Value: 0 - 0 - AllowOnlineID - Dword - - +Value: 0 + 0 + AllowOnlineID + Dword + + <VulnDiscussion>Certain encryption types are no longer considered secure. The DES and RC4 encryption suites must not be used for Kerberos encryption. -Note: Removing the previously allowed RC4_HMAC_MD5 encryption suite may have operational impacts and must be thoroughly tested for the environment before changing. This includes but is not limited to parent\child trusts where RC4 is still enabled; selecting "The other domain supports Kerberos AES Encryption" may be required on the domain trusts to allow client communication across the trust relationship.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters - False - +Note: Removing the previously allowed RC4_HMAC_MD5 encryption suite may have operational impacts and must be thoroughly tested for the environment before changing. This includes but is not limited to parent\child trusts where RC4 is still enabled; selecting "The other domain supports Kerberos AES Encryption" may be required on the domain trusts to allow client communication across the trust relationship.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE @@ -5738,19 +5719,19 @@ Value Name: SupportedEncryptionTypes Value Type: REG_DWORD Value: 0x7ffffff8 (2147483640) -Note: Removing the previously allowed RC4_HMAC_MD5 encryption suite may have operational impacts and must be thoroughly tested for the environment before changing. This includes but is not limited to parent\child trusts where RC4 is still enabled; selecting "The other domain supports Kerberos AES Encryption" may be required on the domain trusts to allow client communication across the trust relationship. - 2147483640 - SupportedEncryptionTypes - Dword - - - <VulnDiscussion>Configuring the system to disable IPv6 source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters - False - +Note: Removing the previously allowed RC4_HMAC_MD5 encryption suite may have operational impacts and must be thoroughly tested for the environment before changing. This includes but is not limited to parent\child trusts where RC4 is still enabled; selecting "The other domain supports Kerberos AES Encryption" may be required on the domain trusts to allow client communication across the trust relationship. + 2147483640 + SupportedEncryptionTypes + Dword + + + <VulnDiscussion>Configuring the system to disable IPv6 source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5759,19 +5740,19 @@ Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ Value Name: DisableIPSourceRouting Type: REG_DWORD -Value: 2 - 2 - DisableIPSourceRouting - Dword - - - <VulnDiscussion>Configuring Windows to limit the number of times that IPv6 TCP retransmits unacknowledged data segments before aborting the attempt helps prevent resources from becoming exhausted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters - True - '{0}' -le '3' +Value: 2 + 2 + DisableIPSourceRouting + Dword + + + <VulnDiscussion>Configuring Windows to limit the number of times that IPv6 TCP retransmits unacknowledged data segments before aborting the attempt helps prevent resources from becoming exhausted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters + True + '{0}' -le '3' If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5780,19 +5761,19 @@ Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ Value Name: TcpMaxDataRetransmissions Value Type: REG_DWORD -Value: 3 (or less) - - TcpMaxDataRetransmissions - Dword - - - <VulnDiscussion>Selecting an incorrect network location may allow greater exposure of a system. Elevation is required by default on nondomain systems to change network location. This setting configures elevation to also be required on domain-joined systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Network Connections - False - +Value: 3 (or less) + + TcpMaxDataRetransmissions + Dword + + + <VulnDiscussion>Selecting an incorrect network location may allow greater exposure of a system. Elevation is required by default on nondomain systems to change network location. This setting configures elevation to also be required on domain-joined systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Network Connections + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5801,19 +5782,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\Network Connections\ Value Name: NC_StdDomainUserSetLocation Type: REG_DWORD -Value: 1 - 1 - NC_StdDomainUserSetLocation - Dword - - - <VulnDiscussion>Routing all Direct Access traffic through the internal network allows monitoring and prevents split tunneling.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\TCPIP\v6Transition - False - +Value: 1 + 1 + NC_StdDomainUserSetLocation + Dword + + + <VulnDiscussion>Routing all Direct Access traffic through the internal network allows monitoring and prevents split tunneling.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\TCPIP\v6Transition + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5822,20 +5803,20 @@ Registry Path: \Software\Policies\Microsoft\Windows\TCPIP\v6Transition\ Value Name: Force_Tunneling Type: REG_SZ -Value: Enabled - Enabled - Force_Tunneling - String - - +Value: Enabled + Enabled + Force_Tunneling + String + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting will prevent Windows from searching Windows Update for point and print drivers. Only the local driver store and server driver cache will be searched.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers - False - +This setting will prevent Windows from searching Windows Update for point and print drivers. Only the local driver store and server driver cache will be searched.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5844,20 +5825,20 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Printers\ Value Name: DoNotInstallCompatibleDriverFromWindowsUpdate Type: REG_DWORD -Value: 1 - 1 - DoNotInstallCompatibleDriverFromWindowsUpdate - Dword - - +Value: 1 + 1 + DoNotInstallCompatibleDriverFromWindowsUpdate + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting will prevent Windows from retrieving device metadata from the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Device Metadata - False - +This setting will prevent Windows from retrieving device metadata from the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Device Metadata + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5866,20 +5847,20 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Device Metadata\ Value Name: PreventDeviceMetadataFromNetwork Value Type: REG_DWORD -Value: 1 - 1 - PreventDeviceMetadataFromNetwork - Dword - - +Value: 1 + 1 + PreventDeviceMetadataFromNetwork + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting will prevent the system from searching Windows Update for device drivers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DriverSearching - False - +This setting will prevent the system from searching Windows Update for device drivers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DriverSearching + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5888,20 +5869,20 @@ Registry Path: \Software\Policies\Microsoft\Windows\DriverSearching\ Value Name: SearchOrderConfig Type: REG_DWORD -Value: 0 - 0 - SearchOrderConfig - Dword - - +Value: 0 + 0 + SearchOrderConfig + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents the MSDT from communicating with and sending collected data to Microsoft, the default support provider.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy - False - +This setting prevents the MSDT from communicating with and sending collected data to Microsoft, the default support provider.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5910,20 +5891,20 @@ Registry Path: \Software\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\ Value Name: DisableQueryRemoteServer Type: REG_DWORD -Value: 0 - 0 - DisableQueryRemoteServer - Dword - - +Value: 0 + 0 + DisableQueryRemoteServer + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents users from searching troubleshooting content on Microsoft servers. Only local content will be available.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy - False - +This setting prevents users from searching troubleshooting content on Microsoft servers. Only local content will be available.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5932,20 +5913,20 @@ Registry Path: \Software\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\ Value Name: EnableQueryRemoteServer Type: REG_DWORD -Value: 0 - 0 - EnableQueryRemoteServer - Dword - - +Value: 0 + 0 + EnableQueryRemoteServer + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting prevents responsiveness events from being aggregated and sent to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d} - False - +This setting prevents responsiveness events from being aggregated and sent to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d} + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5954,20 +5935,20 @@ Registry Path: \Software\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781 Value Name: ScenarioExecutionEnabled Type: REG_DWORD -Value: 0 - 0 - ScenarioExecutionEnabled - Dword - - +Value: 0 + 0 + ScenarioExecutionEnabled + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting will prevent the Program Inventory from collecting data about a system and sending the information to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppCompat - False - +This setting will prevent the Program Inventory from collecting data about a system and sending the information to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppCompat + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5976,19 +5957,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\AppCompat\ Value Name: DisableInventory Type: REG_DWORD -Value: 1 - 1 - DisableInventory - Dword - - - <VulnDiscussion>Allowing Autoplay to execute may introduce malicious code to a system. Autoplay begins reading from a drive as soon as media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. This setting will disable Autoplay for non-volume devices (such as Media Transfer Protocol (MTP) devices).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer - False - +Value: 1 + 1 + DisableInventory + Dword + + + <VulnDiscussion>Allowing Autoplay to execute may introduce malicious code to a system. Autoplay begins reading from a drive as soon as media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. This setting will disable Autoplay for non-volume devices (such as Media Transfer Protocol (MTP) devices).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -5997,19 +5978,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\Explorer\ Value Name: NoAutoplayfornonVolume Type: REG_DWORD -Value: 1 - 1 - NoAutoplayfornonVolume - Dword - - - <VulnDiscussion>Data Execution Prevention (DEP) provides additional protection by performing checks on memory to help prevent malicious code from running. This setting will prevent Data Execution Prevention from being turned off for File Explorer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer - False - +Value: 1 + 1 + NoAutoplayfornonVolume + Dword + + + <VulnDiscussion>Data Execution Prevention (DEP) provides additional protection by performing checks on memory to help prevent malicious code from running. This setting will prevent Data Execution Prevention from being turned off for File Explorer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6018,19 +5999,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\Explorer\ Value Name: NoDataExecutionPrevention Type: REG_DWORD -Value: 0 - 0 - NoDataExecutionPrevention - Dword - - - <VulnDiscussion>Allowing Autorun commands to execute may introduce malicious code to a system. Configuring this setting prevents Autorun commands from executing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer - False - +Value: 0 + 0 + NoDataExecutionPrevention + Dword + + + <VulnDiscussion>Allowing Autorun commands to execute may introduce malicious code to a system. Configuring this setting prevents Autorun commands from executing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6039,19 +6020,19 @@ Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoAutorun Type: REG_DWORD -Value: 1 - 1 - NoAutorun - Dword - - - <VulnDiscussion>Anonymous enumeration of SAM accounts allows anonymous log on users (null session connections) to list all accounts names, thus providing a list of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa - False - +Value: 1 + 1 + NoAutorun + Dword + + + <VulnDiscussion>Anonymous enumeration of SAM accounts allows anonymous log on users (null session connections) to list all accounts names, thus providing a list of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6060,19 +6041,19 @@ Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: RestrictAnonymousSAM Value Type: REG_DWORD -Value: 1 - 1 - RestrictAnonymousSAM - Dword - - - <VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System - True - '{0}' -match '^(DoD Notice and Consent Banner|US Department of Defense Warning Statement)$' +Value: 1 + 1 + RestrictAnonymousSAM + Dword + + + <VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System + True + '{0}' -match '^(DoD Notice and Consent Banner|US Department of Defense Warning Statement)$' If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6087,19 +6068,19 @@ Value: See message title options below If a site-defined title is used, it can in no case contravene or modify the language of the banner text required in V-1089. -Automated tools may only search for the titles defined above. If a site-defined title is used, a manual review will be required. - - LegalNoticeCaption - String - - - <VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\TCPIP\v6Transition - False - +Automated tools may only search for the titles defined above. If a site-defined title is used, a manual review will be required. + + LegalNoticeCaption + String + + + <VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\TCPIP\v6Transition + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6108,19 +6089,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\TCPIP\v6Transition\ Value Name: 6to4_State Type: REG_SZ -Value: Disabled - Disabled - 6to4_State - String - - - <VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\TCPIP\v6Transition\IPHTTPS\IPHTTPSInterface - False - +Value: Disabled + Disabled + 6to4_State + String + + + <VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\TCPIP\v6Transition\IPHTTPS\IPHTTPSInterface + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6129,19 +6110,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\TCPIP\v6Transition\IPHTTPS\I Value Name: IPHTTPS_ClientState Type: REG_DWORD -Value: 3 - 3 - IPHTTPS_ClientState - Dword - - - <VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\TCPIP\v6Transition - False - +Value: 3 + 3 + IPHTTPS_ClientState + Dword + + + <VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\TCPIP\v6Transition + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6150,19 +6131,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\TCPIP\v6Transition\ Value Name: ISATAP_State Type: REG_SZ -Value: Disabled - Disabled - ISATAP_State - String - - - <VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\TCPIP\v6Transition - False - +Value: Disabled + Disabled + ISATAP_State + String + + + <VulnDiscussion>IPv6 transition technologies, which tunnel packets through other protocols, do not provide visibility.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\TCPIP\v6Transition + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6171,19 +6152,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\TCPIP\v6Transition\ Value Name: Teredo_State Type: REG_SZ -Value: Disabled - Disabled - Teredo_State - String - - - <VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application - True - '{0}' -ge '32768' +Value: Disabled + Disabled + Teredo_State + String + + + <VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application + True + '{0}' -ge '32768' If the system is configured to write events directly to an audit server, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -6194,19 +6175,19 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Application\ Value Name: MaxSize Type: REG_DWORD -Value: 0x00008000 (32768) (or greater) - - MaxSize - Dword - - - <VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security - True - '{0}' -ge '196608' +Value: 0x00008000 (32768) (or greater) + + MaxSize + Dword + + + <VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security + True + '{0}' -ge '196608' If the system is configured to write events directly to an audit server, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -6217,19 +6198,19 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Security\ Value Name: MaxSize Type: REG_DWORD -Value: 0x00030000 (196608) (or greater) - - MaxSize - Dword - - - <VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup - True - '{0}' -ge '32768' +Value: 0x00030000 (196608) (or greater) + + MaxSize + Dword + + + <VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup + True + '{0}' -ge '32768' If the system is configured to write events directly to an audit server, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -6240,19 +6221,19 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Setup\ Value Name: MaxSize Type: REG_DWORD -Value: 0x00008000 (32768) (or greater) - - MaxSize - Dword - - - <VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\System - True - '{0}' -ge '32768' +Value: 0x00008000 (32768) (or greater) + + MaxSize + Dword + + + <VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\System + True + '{0}' -ge '32768' If the system is configured to write events directly to an audit server, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -6263,20 +6244,20 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\System\ Value Name: MaxSize Type: REG_DWORD -Value: 0x00008000 (32768) (or greater) - - MaxSize - Dword - - +Value: 0x00008000 (32768) (or greater) + + MaxSize + Dword + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system. -This setting will prevent Windows from sending an error report to Microsoft when a device driver requests additional software during installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Settings - False - +This setting will prevent Windows from sending an error report to Microsoft when a device driver requests additional software during installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Settings + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6285,19 +6266,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\DeviceInstall\Settings\ Value Name: DisableSendRequestAdditionalSoftwareToWER Type: REG_DWORD -Value: 1 - 1 - DisableSendRequestAdditionalSoftwareToWER - Dword - - - <VulnDiscussion>Standard user accounts must not be granted elevated privileges. Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer - False - +Value: 1 + 1 + DisableSendRequestAdditionalSoftwareToWER + Dword + + + <VulnDiscussion>Standard user accounts must not be granted elevated privileges. Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6306,21 +6287,21 @@ Registry Path: \Software\Policies\Microsoft\Windows\Installer\ Value Name: AlwaysInstallElevated Type: REG_DWORD -Value: 0 - 0 - AlwaysInstallElevated - Dword - - +Value: 0 + 0 + AlwaysInstallElevated + Dword + + <VulnDiscussion>A compromised local administrator account can provide means for an attacker to move laterally between domain systems. -With User Account Control enabled, filtering the privileged token for local administrator accounts will prevent the elevated privileges of these accounts from being used over the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System - False - +With User Account Control enabled, filtering the privileged token for local administrator accounts will prevent the elevated privileges of these accounts from being used over the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + If the system is not a member of a domain, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -6332,19 +6313,19 @@ Value Name: LocalAccountTokenFilterPolicy Type: REG_DWORD Value: 0x00000000 (0) -This setting may cause issues with some network scanning tools if local administrative accounts are used remotely. Scans should use domain accounts where possible. If a local administrative account must be used, temporarily enabling the privileged token by configuring the registry value to 1 may be required. - 0 - LocalAccountTokenFilterPolicy - Dword - - - <VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked when unattended. Enabling a password-protected screen saver to engage after a specified period of time helps protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Control Panel\Desktop - False - +This setting may cause issues with some network scanning tools if local administrative accounts are used remotely. Scans should use domain accounts where possible. If a local administrative account must be used, temporarily enabling the privileged token by configuring the registry value to 1 may be required. + 0 + LocalAccountTokenFilterPolicy + Dword + + + <VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked when unattended. Enabling a password-protected screen saver to engage after a specified period of time helps protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Control Panel\Desktop + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER @@ -6358,19 +6339,19 @@ Value: 1 Applications requiring continuous, real-time screen display (e.g., network management products) require the following and must be documented with the ISSO: -The logon session does not have administrator rights. --The display station (e.g., keyboard, monitor, etc.) is located in a controlled access area. - 1 - ScreenSaveActive - String - - - <VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked when unattended. Enabling a password-protected screen saver to engage after a specified period of time helps protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>PESL-1</IAControls> - - Present - False - HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Control Panel\Desktop - False - +-The display station (e.g., keyboard, monitor, etc.) is located in a controlled access area. + 1 + ScreenSaveActive + String + + + <VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked when unattended. Enabling a password-protected screen saver to engage after a specified period of time helps protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>PESL-1</IAControls> + + Present + False + HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Control Panel\Desktop + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER @@ -6379,19 +6360,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\Control Panel\Desktop\ Value Name: ScreenSaverIsSecure Type: REG_SZ -Value: 1 - 1 - ScreenSaverIsSecure - String - - - <VulnDiscussion>IP stateless autoconfiguration could configure routes that circumvent preferred routes if not limited.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters - False - +Value: 1 + 1 + ScreenSaverIsSecure + String + + + <VulnDiscussion>IP stateless autoconfiguration could configure routes that circumvent preferred routes if not limited.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6400,19 +6381,19 @@ Registry Path: \System\CurrentControlSet\Services\Tcpip\Parameters\ Value Name: EnableIPAutoConfigurationLimits Type: REG_DWORD -Value: 1 - 1 - EnableIPAutoConfigurationLimits - Dword - - - <VulnDiscussion>Uncontrolled system updates can introduce issues to a system. Obtaining update components from an outside source may also potentially provide sensitive information outside of the enterprise. Optional component installation or repair must be obtained from an internal source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Servicing - False - +Value: 1 + 1 + EnableIPAutoConfigurationLimits + Dword + + + <VulnDiscussion>Uncontrolled system updates can introduce issues to a system. Obtaining update components from an outside source may also potentially provide sensitive information outside of the enterprise. Optional component installation or repair must be obtained from an internal source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Servicing + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6421,19 +6402,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Servicing\ Value Name: UseWindowsUpdate Type: REG_DWORD -Value: 2 - 2 - UseWindowsUpdate - Dword - - - <VulnDiscussion>Uncontrolled system updates can introduce issues to a system. Obtaining update components from an outside source may also potentially provide sensitive information outside of the enterprise. Device driver updates must be obtained from an internal source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DriverSearching - False - +Value: 2 + 2 + UseWindowsUpdate + Dword + + + <VulnDiscussion>Uncontrolled system updates can introduce issues to a system. Obtaining update components from an outside source may also potentially provide sensitive information outside of the enterprise. Device driver updates must be obtained from an internal source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DriverSearching + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6442,19 +6423,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\DriverSearching\ Value Name: DriverServerSelection Type: REG_DWORD -Value: 1 - 1 - DriverServerSelection - Dword - - - <VulnDiscussion>Compromised boot drivers can introduce malware prior to some protection mechanisms that load after initialization. The Early Launch Antimalware driver can limit allowed drivers based on classifications determined by the malware protection application. At a minimum, drivers determined to be bad must not be allowed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECVP-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\System\CurrentControlSet\Policies\EarlyLaunch - False - +Value: 1 + 1 + DriverServerSelection + Dword + + + <VulnDiscussion>Compromised boot drivers can introduce malware prior to some protection mechanisms that load after initialization. The Early Launch Antimalware driver can limit allowed drivers based on classifications determined by the malware protection application. At a minimum, drivers determined to be bad must not be allowed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECVP-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\System\CurrentControlSet\Policies\EarlyLaunch + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6463,19 +6444,19 @@ Registry Path: \System\CurrentControlSet\Policies\EarlyLaunch\ Value Name: DriverLoadPolicy Type: REG_DWORD -Value: 1 - 1 - DriverLoadPolicy - Dword - - - <VulnDiscussion>Uncontrolled installation of applications can introduce various issues, including system instability, and allow access to sensitive information. Installation of applications must be controlled by the enterprise. Turning off access to the Windows Store will limit access to publicly available applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer - False - +Value: 1 + 1 + DriverLoadPolicy + Dword + + + <VulnDiscussion>Uncontrolled installation of applications can introduce various issues, including system instability, and allow access to sensitive information. Installation of applications must be controlled by the enterprise. Turning off access to the Windows Store will limit access to publicly available applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer + False + The Windows Store is not installed by default. If the \Windows\WinStore directory does not exist, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -6486,19 +6467,19 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ Value Name: NoUseStoreOpenWith Type: REG_DWORD -Value: 1 - 1 - NoUseStoreOpenWith - Dword - - - <VulnDiscussion>Allowing different input methods for sign-in could open different avenues of attack. User input methods must be restricted to those enabled for the system account at sign-in.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Control Panel\International - False - +Value: 1 + 1 + NoUseStoreOpenWith + Dword + + + <VulnDiscussion>Allowing different input methods for sign-in could open different avenues of attack. User input methods must be restricted to those enabled for the system account at sign-in.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Control Panel\International + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6507,19 +6488,19 @@ Registry Path: \Software\Policies\Microsoft\Control Panel\International\ Value Name: BlockUserInputMethodsForSignIn Type: REG_DWORD -Value: 1 - 1 - BlockUserInputMethodsForSignIn - Dword - - - <VulnDiscussion>The username is one part of logon credentials that could be used to gain access to a system. Preventing the enumeration of users limits this information to authorized personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System - False - +Value: 1 + 1 + BlockUserInputMethodsForSignIn + Dword + + + <VulnDiscussion>The username is one part of logon credentials that could be used to gain access to a system. Preventing the enumeration of users limits this information to authorized personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6528,19 +6509,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\System\ Value Name: EnumerateLocalUsers Type: REG_DWORD -Value: 0 - 0 - EnumerateLocalUsers - Dword - - - <VulnDiscussion>App notifications that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System - False - +Value: 0 + 0 + EnumerateLocalUsers + Dword + + + <VulnDiscussion>App notifications that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6549,19 +6530,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\System\ Value Name: DisableLockScreenAppNotifications Type: REG_DWORD -Value: 1 - 1 - DisableLockScreenAppNotifications - Dword - - - <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this feature will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppCompat - False - +Value: 1 + 1 + DisableLockScreenAppNotifications + Dword + + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this feature will prevent potentially sensitive information from being sent outside the enterprise and uncontrolled updates to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppCompat + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6570,19 +6551,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\AppCompat\ Value Name: DisablePcaUI Type: REG_DWORD -Value: 0 - 0 - DisablePcaUI - Dword - - - <VulnDiscussion>Enabling trusted app installation allows for enterprise line of business Windows 8 type apps. A trusted app package is one that is signed with a certificate chain that can be successfully validated in the enterprise. Configuring this ensures enterprise line of business apps are accessible.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Appx - False - +Value: 0 + 0 + DisablePcaUI + Dword + + + <VulnDiscussion>Enabling trusted app installation allows for enterprise line of business Windows 8 type apps. A trusted app package is one that is signed with a certificate chain that can be successfully validated in the enterprise. Configuring this ensures enterprise line of business apps are accessible.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Appx + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6591,19 +6572,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\Appx\ Value Name: AllowAllTrustedApps Type: REG_DWORD -Value: 1 - 1 - AllowAllTrustedApps - Dword - - - <VulnDiscussion>Allowing biometrics may bypass required authentication methods. Biometrics may only be used as an additional authentication factor where an enhanced strength of identity credential is necessary or desirable. Additional factors must be met per DoD policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IAIA-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Biometrics - False - +Value: 1 + 1 + AllowAllTrustedApps + Dword + + + <VulnDiscussion>Allowing biometrics may bypass required authentication methods. Biometrics may only be used as an additional authentication factor where an enhanced strength of identity credential is necessary or desirable. Additional factors must be met per DoD policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IAIA-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Biometrics + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6612,19 +6593,19 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Biometrics\ Value Name: Enabled Type: REG_DWORD -Value: 0 - 0 - Enabled - Dword - - - <VulnDiscussion>Visible passwords may be seen by nearby persons, compromising them. The password reveal button can be used to display an entered password and must not be allowed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IAIA-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CredUI - False - +Value: 0 + 0 + Enabled + Dword + + + <VulnDiscussion>Visible passwords may be seen by nearby persons, compromising them. The password reveal button can be used to display an entered password and must not be allowed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IAIA-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CredUI + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6633,20 +6614,22 @@ Registry Path: \Software\Policies\Microsoft\Windows\CredUI\ Value Name: DisablePasswordReveal Type: REG_DWORD -Value: 1 - 1 - DisablePasswordReveal - Dword - - - <VulnDiscussion>Windows SmartScreen helps protect systems from programs downloaded from the Internet that may be malicious. Warning a user before running downloaded unknown software, at minimum, will help prevent potentially malicious programs from executing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System - True - '{0}' -match '1|2' - If the following registry value does not exist or is not configured as specified, this is a finding: +Value: 1 + 1 + DisablePasswordReveal + Dword + + + <VulnDiscussion>Windows SmartScreen helps protect systems from programs downloaded from the Internet that may be malicious. Warning a user before running downloaded unknown software, at minimum, will help prevent potentially malicious programs from executing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + True + '{0}' -match '1|2' + This is applicable to unclassified systems; for other systems, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ @@ -6654,20 +6637,20 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ Value Name: EnableSmartScreen Type: REG_DWORD -Value: 0x00000001 (1) (Give user a warning…) -Or 0x00000002 (2) (Require approval…) - - EnableSmartScreen - Dword - - - <VulnDiscussion>The location service on systems may allow sensitive data to be used by applications on the system. This should be turned off unless explicitly allowed for approved systems/applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LocationAndSensors - False - +Value: 0x00000001 (1) (Give user a warning…) +Or 0x00000002 (2) (Require approval…) + + EnableSmartScreen + Dword + + + <VulnDiscussion>The location service on systems may allow sensitive data to be used by applications on the system. This should be turned off unless explicitly allowed for approved systems/applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LocationAndSensors + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6678,19 +6661,19 @@ Value Name: DisableLocation Type: REG_DWORD Value: 1 (Enabled) -If location services are approved for the system by the organization, this may be set to "Disabled" (0). This must be documented with the ISSO. - 1 - DisableLocation - Dword - - - <VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Feeds - False - +If location services are approved for the system by the organization, this may be set to "Disabled" (0). This must be documented with the ISSO. + 1 + DisableLocation + Dword + + + <VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Feeds + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6699,53 +6682,53 @@ Registry Path: \Software\Policies\Microsoft\Internet Explorer\Feeds\ Value Name: AllowBasicAuthInClear Type: REG_DWORD -Value: 0 - 0 - AllowBasicAuthInClear - Dword - - - <VulnDiscussion>Uncontrolled system updates can introduce issues to a system. Obtaining update components from an outside source may also potentially allow sensitive information outside of the enterprise. Application updates must be obtained from an internal source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore - False - - Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\WindowsStore\ -Type: REG_DWORD -Value Name: AutoDownload -Value: 0x00000002 (2) - 2 - AutoDownload - Dword - - - <VulnDiscussion>Uncontrolled system updates can introduce issues to a system. Obtaining update components from an outside source may also potentially allow sensitive information outside of the enterprise. Application updates must be obtained from an internal source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore\WindowsUpdate - False - - Registry Hive: HKEY_LOCAL_MACHINE -Registry Path: \SOFTWARE\Policies\Microsoft\WindowsStore\WindowsUpdate\ -Type: REG_DWORD -Value Name: AutoDownload -Value: 0x00000002 (2) - 2 - AutoDownload - Dword - - - <VulnDiscussion>Uncontrolled installation of applications can introduce various issues, including system instability, and provide access to sensitive information. Installation of applications must be controlled by the enterprise. Turning off access to the Windows Store will limit access to publicly available applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore - False - +Value: 0 + 0 + AllowBasicAuthInClear + Dword + + + <VulnDiscussion>Uncontrolled system updates can introduce issues to a system. Obtaining update components from an outside source may also potentially allow sensitive information outside of the enterprise. Application updates must be obtained from an internal source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\WindowsStore\ +Type: REG_DWORD +Value Name: AutoDownload +Value: 0x00000002 (2) + 2 + AutoDownload + Dword + + + <VulnDiscussion>Uncontrolled system updates can introduce issues to a system. Obtaining update components from an outside source may also potentially allow sensitive information outside of the enterprise. Application updates must be obtained from an internal source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore\WindowsUpdate + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\WindowsStore\WindowsUpdate\ +Type: REG_DWORD +Value Name: AutoDownload +Value: 0x00000002 (2) + 2 + AutoDownload + Dword + + + <VulnDiscussion>Uncontrolled installation of applications can introduce various issues, including system instability, and provide access to sensitive information. Installation of applications must be controlled by the enterprise. Turning off access to the Windows Store will limit access to publicly available applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore + False + The Windows Store is not installed by default. If the \Windows\WinStore directory does not exist, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: @@ -6755,19 +6738,19 @@ Registry Path: \SOFTWARE\Policies\Microsoft\WindowsStore\ Value Name: RemoveWindowsStore Type: REG_DWORD -Value: 1 - 1 - RemoveWindowsStore - Dword - - - <VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IAIA-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client - False - +Value: 1 + 1 + RemoveWindowsStore + Dword + + + <VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IAIA-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6776,19 +6759,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowBasic Type: REG_DWORD -Value: 0 - 0 - AllowBasic - Dword - - - <VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client - False - +Value: 0 + 0 + AllowBasic + Dword + + + <VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6797,19 +6780,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowUnencryptedTraffic Type: REG_DWORD -Value: 0 - 0 - AllowUnencryptedTraffic - Dword - - - <VulnDiscussion>Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IAIA-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client - False - +Value: 0 + 0 + AllowUnencryptedTraffic + Dword + + + <VulnDiscussion>Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>IAIA-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Client + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6818,19 +6801,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowDigest Type: REG_DWORD -Value: 0 - 0 - AllowDigest - Dword - - - <VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service - False - +Value: 0 + 0 + AllowDigest + Dword + + + <VulnDiscussion>Basic authentication uses plain text passwords that could be used to compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6839,19 +6822,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowBasic Type: REG_DWORD -Value: 0 - 0 - AllowBasic - Dword - - - <VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service - False - +Value: 0 + 0 + AllowBasic + Dword + + + <VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6860,19 +6843,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowUnencryptedTraffic Type: REG_DWORD -Value: 0 - 0 - AllowUnencryptedTraffic - Dword - - - <VulnDiscussion>Storage of administrative credentials could allow unauthorized access. Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLP-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service - False - +Value: 0 + 0 + AllowUnencryptedTraffic + Dword + + + <VulnDiscussion>Storage of administrative credentials could allow unauthorized access. Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECLP-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6881,19 +6864,19 @@ Registry Path: \Software\Policies\Microsoft\Windows\WinRM\Service\ Value Name: DisableRunAs Type: REG_DWORD -Value: 1 - 1 - DisableRunAs - Dword - - - <VulnDiscussion>Unattended systems are susceptible to unauthorized use and should be locked when unattended. The screen saver should be set at a maximum of 15 minutes and be password protected. This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System - True - '{0}' -le '900' -and '{0}' -gt '0' +Value: 1 + 1 + DisableRunAs + Dword + + + <VulnDiscussion>Unattended systems are susceptible to unauthorized use and should be locked when unattended. The screen saver should be set at a maximum of 15 minutes and be password protected. This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System + True + '{0}' -le '900' -and '{0}' -gt '0' If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6902,19 +6885,19 @@ Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: InactivityTimeoutSecs Value Type: REG_DWORD -Value: 0x00000384 (900) (or less, excluding "0" which is effectively disabled) - - InactivityTimeoutSecs - Dword - - - <VulnDiscussion>The Windows Push Notification Service (WNS) allows third-party vendors to send updates for toasts, tiles, and badges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications - False - +Value: 0x00000384 (900) (or less, excluding "0" which is effectively disabled) + + InactivityTimeoutSecs + Dword + + + <VulnDiscussion>The Windows Push Notification Service (WNS) allows third-party vendors to send updates for toasts, tiles, and badges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER @@ -6923,19 +6906,19 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotificat Value Name: NoCloudApplicationNotification Type: REG_DWORD -Value: 1 - 1 - NoCloudApplicationNotification - Dword - - - <VulnDiscussion>Toast notifications that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications - False - +Value: 1 + 1 + NoCloudApplicationNotification + Dword + + + <VulnDiscussion>Toast notifications that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER @@ -6944,19 +6927,19 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotificat Value Name: NoToastApplicationNotificationOnLockScreen Type: REG_DWORD -Value: 1 - 1 - NoToastApplicationNotificationOnLockScreen - Dword - - - <VulnDiscussion>Allowing the redirection of only the default client printer to a Remote Desktop session helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services - False - +Value: 1 + 1 + NoToastApplicationNotificationOnLockScreen + Dword + + + <VulnDiscussion>Allowing the redirection of only the default client printer to a Remote Desktop session helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -6965,19 +6948,19 @@ Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: RedirectOnlyDefaultClientPrinter Type: REG_DWORD -Value: 1 - 1 - RedirectOnlyDefaultClientPrinter - Dword - - - <VulnDiscussion>Slide shows that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization - False - +Value: 1 + 1 + RedirectOnlyDefaultClientPrinter + Dword + + + <VulnDiscussion>Slide shows that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization + False + This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. @@ -6988,21 +6971,21 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Personalization\ Value Name: NoLockScreenSlideshow Value Type: REG_DWORD -Value: 1 - 1 - NoLockScreenSlideshow - Dword - - +Value: 1 + 1 + NoLockScreenSlideshow + Dword + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. -Enabling "Include command line data for process creation events" will record the command line information with the process creation events in the log. This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit - False - +Enabling "Include command line data for process creation events" will record the command line information with the process creation events in the log. This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit + False + This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. @@ -7013,19 +6996,19 @@ Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ Value Name: ProcessCreationIncludeCmdLine_Enabled Value Type: REG_DWORD -Value: 0x00000001 (1) - 1 - ProcessCreationIncludeCmdLine_Enabled - Dword - - - <VulnDiscussion>Enabling interaction with the network selection UI allows users to change connections to available networks without signing into Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System - False - +Value: 0x00000001 (1) + 1 + ProcessCreationIncludeCmdLine_Enabled + Dword + + + <VulnDiscussion>Enabling interaction with the network selection UI allows users to change connections to available networks without signing into Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + False + This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. @@ -7036,19 +7019,19 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ Value Name: DontDisplayNetworkSelectionUI Value Type: REG_DWORD -Value: 1 - 1 - DontDisplayNetworkSelectionUI - Dword - - - <VulnDiscussion>Control of credentials and the system must be maintained within the enterprise. Enabling this setting allows enterprise credentials to be used with modern style apps that support this, instead of Microsoft accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System - False - +Value: 1 + 1 + DontDisplayNetworkSelectionUI + Dword + + + <VulnDiscussion>Control of credentials and the system must be maintained within the enterprise. Enabling this setting allows enterprise credentials to be used with modern style apps that support this, instead of Microsoft accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. @@ -7059,19 +7042,19 @@ Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Value Name: MSAOptional Value Type: REG_DWORD -Value: 1 - 1 - MSAOptional - Dword - - - <VulnDiscussion>Windows 2012 R2 can be configured to automatically sign the user back in after a Windows Update restart. Some protections are in place to help ensure this is done in a secure fashion; however, disabling this will prevent the caching of credentials for this purpose and also ensure the user is aware of the restart.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System - False - +Value: 1 + 1 + MSAOptional + Dword + + + <VulnDiscussion>Windows 2012 R2 can be configured to automatically sign the user back in after a Windows Update restart. Some protections are in place to help ensure this is done in a secure fashion; however, disabling this will prevent the caching of credentials for this purpose and also ensure the user is aware of the restart.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + This requirement is NA for the initial release of Windows 2012. It is applicable to Windows 2012 R2. Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. @@ -7082,25 +7065,25 @@ Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: DisableAutomaticRestartSignOn Value Type: REG_DWORD -Value: 1 - 1 - DisableAutomaticRestartSignOn - Dword - - +Value: 1 + 1 + DisableAutomaticRestartSignOn + Dword + + <VulnDiscussion>If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure. The cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user. -Both the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography - False - +Both the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography + False + If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE @@ -7109,19 +7092,19 @@ Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\ Value Name: ForceKeyProtection Type: REG_DWORD -Value: 2 - 2 - ForceKeyProtection - Dword - - - <VulnDiscussion>When the WDigest Authentication protocol is enabled, plain text passwords are stored in the Local Security Authority Subsystem Service (LSASS) exposing them to theft. This setting will prevent WDigest from storing credentials in memory.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest - False - +Value: 2 + 2 + ForceKeyProtection + Dword + + + <VulnDiscussion>When the WDigest Authentication protocol is enabled, plain text passwords are stored in the Local Security Authority Subsystem Service (LSASS) exposing them to theft. This setting will prevent WDigest from storing credentials in memory.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest + False + If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE @@ -7132,21 +7115,21 @@ Value Name: UseLogonCredential Type: REG_DWORD Value: 0x00000000 (0) -Note: Microsoft Security Advisory update 2871997 is required for this setting to be effective on Windows 2012. It is not required for Windows 2012 R2. - 0 - UseLogonCredential - Dword - - +Note: Microsoft Security Advisory update 2871997 is required for this setting to be effective on Windows 2012. It is not required for Windows 2012 R2. + 0 + UseLogonCredential + Dword + + <VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant. -Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters - False - +Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters + False + This requirement specifically applies to Windows 2012 but can also be used for Windows 2012 R2. Different methods are available to disable SMBv1 on Windows 2012 R2, if V-73805 is configured on Windows 2012 R2, this is NA. @@ -7159,23 +7142,23 @@ Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\ Value Name: SMB1 Type: REG_DWORD -Value: 0x00000000 (0) - 0 - SMB1 - Dword - - +Value: 0x00000000 (0) + 0 + SMB1 + Dword + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Enabling PowerShell script block logging will record detailed information from the processing of PowerShell commands and scripts. This can provide additional detail when malware has run on a system. -PowerShell 5.x supports script block logging. PowerShell 4.0 with the addition of patch KB3000850 on Windows 2012 R2 or KB3119938 on Windows 2012 adds support for script block logging.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging - False - +PowerShell 5.x supports script block logging. PowerShell 4.0 with the addition of patch KB3000850 on Windows 2012 R2 or KB3119938 on Windows 2012 adds support for script block logging.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging + False + If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE @@ -7190,97 +7173,97 @@ PowerShell 4.0 requires the installation of patch KB3000850 on Windows 2012 R2 o If the patch is not installed on systems with PowerShell 4.0, this is a finding. -PowerShell 5.x does not require the installation of an additional patch. - 1 - EnableScriptBlockLogging - Dword - - - - - <VulnDiscussion>A system faces an increased vulnerability threat if the built-in guest account is not disabled. This account is a known account that exists on all Windows systems and cannot be deleted. This account is initialized during the installation of the operating system with no password assigned.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - Accounts: Guest account status - Disabled - False - +PowerShell 5.x does not require the installation of an additional patch. + 1 + EnableScriptBlockLogging + Dword + + + + + <VulnDiscussion>A system faces an increased vulnerability threat if the built-in guest account is not disabled. This account is a known account that exists on all Windows systems and cannot be deleted. This account is initialized during the installation of the operating system with no password assigned.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + Accounts: Guest account status + Disabled + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. -If the value for "Accounts: Guest account status" is not set to "Disabled", this is a finding. - - - <VulnDiscussion>The built-in guest account is a well-known user account on all Windows systems and, as initially installed, does not require a password. This can allow access to system resources by unauthorized users. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - Accounts: Rename guest account - - True - '{0}' -ne 'Guest' +If the value for "Accounts: Guest account status" is not set to "Disabled", this is a finding. + + + <VulnDiscussion>The built-in guest account is a well-known user account on all Windows systems and, as initially installed, does not require a password. This can allow access to system resources by unauthorized users. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + Accounts: Rename guest account + + True + '{0}' -ne 'Guest' Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. -If the value for "Accounts: Rename guest account" is not set to a value other than "Guest", this is a finding. - - - <VulnDiscussion>The built-in administrator account is a well-known account subject to attack. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - Accounts: Rename administrator account - - True - '{0}' -ne 'Administrator' +If the value for "Accounts: Rename guest account" is not set to a value other than "Guest", this is a finding. + + + <VulnDiscussion>The built-in administrator account is a well-known account subject to attack. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + Accounts: Rename administrator account + + True + '{0}' -ne 'Administrator' Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. -If the value for "Accounts: Rename administrator account" is not set to a value other than "Administrator", this is a finding. - - - <VulnDiscussion>Allowing anonymous SID/Name translation can provide sensitive information for accessing a system. Only authorized users must be able to perform such translations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - Network access: Allow anonymous SID/Name translation - Disabled - False - +If the value for "Accounts: Rename administrator account" is not set to a value other than "Administrator", this is a finding. + + + <VulnDiscussion>Allowing anonymous SID/Name translation can provide sensitive information for accessing a system. Only authorized users must be able to perform such translations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + Network access: Allow anonymous SID/Name translation + Disabled + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. -If the value for "Network access: Allow anonymous SID/Name translation" is not set to "Disabled", this is a finding. - - - <VulnDiscussion>Limiting logon hours can help protect data by only allowing access during specified times. This setting controls whether or not users are forced to log off when their allowed logon hours expire. If logon hours are set for users, this must be enforced.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - Network security: Force logoff when logon hours expire - Enabled - False - +If the value for "Network access: Allow anonymous SID/Name translation" is not set to "Disabled", this is a finding. + + + <VulnDiscussion>Limiting logon hours can help protect data by only allowing access during specified times. This setting controls whether or not users are forced to log off when their allowed logon hours expire. If logon hours are set for users, this must be enforced.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + Network security: Force logoff when logon hours expire + Enabled + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. -If the value for "Network security: Force logoff when logon hours expire" is not set to "Enabled", this is a finding. - - - - - <VulnDiscussion>The McAfee Agent is the client side distributed component of McAfee ePolicy Orchestrator (McAfee ePO) which provides a secure communication channel between the ePO server and managed point products.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +If the value for "Network security: Force logoff when logon hours expire" is not set to "Enabled", this is a finding. + + + + + <VulnDiscussion>The McAfee Agent is the client side distributed component of McAfee ePolicy Orchestrator (McAfee ePO) which provides a secure communication channel between the ePO server and managed point products.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + Run "Services.msc". Verify the McAfee Agent service is running, depending on the version installed. @@ -7289,159 +7272,159 @@ Version - Service Name McAfee Agent v5.x - McAfee Agent Service McAfee Agent v4.x - McAfee Framework Service -If the service is not listed or does not have a Status of "Started", this is a finding. - masvc - Running - Automatic - - - <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - False - +If the service is not listed or does not have a Status of "Started", this is a finding. + masvc + Running + Automatic + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + False + Verify the Fax (fax) service is not installed or is disabled. Run "Services.msc". If the following is installed and not disabled, this is a finding: -Fax (fax) - fax - Stopped - Disabled - - - <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - False - +Fax (fax) + fax + Stopped + Disabled + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + If the server has the role of an FTP server, this is NA. Run "Services.msc". -If the "Microsoft FTP Service" (Service name: FTPSVC) is installed and not disabled, this is a finding. - FTPSVC - Stopped - Disabled - - - <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - False - +If the "Microsoft FTP Service" (Service name: FTPSVC) is installed and not disabled, this is a finding. + FTPSVC + Stopped + Disabled + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + False + Verify the Peer Network Identity Manager (p2pimsvc) service is not installed or is disabled. Run "Services.msc". If the following is installed and not disabled, this is a finding: -Peer Networking Identity Manager (p2pimsvc) - p2pimsvc - Stopped - Disabled - - - <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - False - +Peer Networking Identity Manager (p2pimsvc) + p2pimsvc + Stopped + Disabled + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + False + Verify the Simple TCP/IP (simptcp) service is not installed or is disabled. Run "Services.msc". If the following is installed and not disabled, this is a finding: -Simple TCP/IP Services (simptcp) - simptcp - Stopped - Disabled - - - <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - False - +Simple TCP/IP Services (simptcp) + simptcp + Stopped + Disabled + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + False + Verify the Telnet (tlntsvr) service is not installed or is disabled. Run "Services.msc". If the following is installed and not disabled, this is a finding: -Telnet (tlntsvr) - tlntsvr - Stopped - Disabled - - - <VulnDiscussion>Failure to verify a certificate's revocation status can result in the system accepting a revoked, and therefore unauthorized, certificate. This could result in the installation of unauthorized software or a connection for rogue networks, depending on the use for which the certificate is intended. Querying for certificate revocation mitigates the risk that the system will accept an unauthorized certificate.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Present - False - True - ServiceName/StartupType is populated with correct Certificate Revocation Checking service information - Verify the system has software installed and running that provides certificate validation and revocation checking. If it does not, this is a finding. - - - Running - - - - - <VulnDiscussion>The automatic start of the Smart Card Removal Policy service is required to support the smart card removal behavior requirement.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - False - +Telnet (tlntsvr) + tlntsvr + Stopped + Disabled + + + <VulnDiscussion>Failure to verify a certificate's revocation status can result in the system accepting a revoked, and therefore unauthorized, certificate. This could result in the installation of unauthorized software or a connection for rogue networks, depending on the use for which the certificate is intended. Querying for certificate revocation mitigates the risk that the system will accept an unauthorized certificate.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + True + ServiceName/StartupType is populated with correct Certificate Revocation Checking service information + Verify the system has software installed and running that provides certificate validation and revocation checking. If it does not, this is a finding. + + + Running + + + + + <VulnDiscussion>The automatic start of the Smart Card Removal Policy service is required to support the smart card removal behavior requirement.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + False + Verify the Smart Card Removal Policy service is configured to "Automatic". Run "Services.msc". -If the Startup Type for Smart Card Removal Policy is not set to Automatic, this is a finding. - SCPolicySvc - Running - Automatic - - - <VulnDiscussion>A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> - - Present - False - True - ServiceName/StartupType is populated with correct Firewall service information +If the Startup Type for Smart Card Removal Policy is not set to Automatic, this is a finding. + SCPolicySvc + Running + Automatic + + + <VulnDiscussion>A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECSC-1</IAControls> + + Present + False + True + ServiceName/StartupType is populated with correct Firewall service information Determine if a host-based firewall is installed and enabled on the system. If a host-based firewall is not installed and enabled on the system, this is a finding. -The configuration requirements will be determined by the applicable firewall STIG. - - - Running - - - - - - - SeTcbPrivilege +The configuration requirements will be determined by the applicable firewall STIG. + + + Running + + + + + + + SeTcbPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Act as part of the operating system" user right can assume the identity of any user and gain access to resources that user is authorized to access. Any accounts with this right can take complete control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Act as part of the operating system - - True - NULL - False - False - +Accounts with the "Act as part of the operating system" user right can assume the identity of any user and gain access to resources that user is authorized to access. Any accounts with this right can take complete control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Act as part of the operating system + + True + NULL + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -7456,10 +7439,10 @@ Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). - - - SeDenyNetworkLogonRight +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). + + + SeDenyNetworkLogonRight <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Deny access to this computer from the network" user right defines the accounts that are prevented from logging on from the network. @@ -7468,14 +7451,14 @@ In an Active Directory Domain, denying logons to the Enterprise Admins and Domai Local accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks. -The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Deny access to this computer from the network - - False - - False - True - '{0}' -match 'Enterprise Admins,Domain Admins,(Local account and member of Administrators group|Local account),Guests' +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Deny access to this computer from the network + + False + + False + True + '{0}' -match 'Enterprise Admins,Domain Admins,(Local account and member of Administrators group|Local account),Guests' Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -7493,20 +7476,20 @@ All Systems: Guests group Note: Windows Server 2012 R2 added new built-in security groups, "Local account" and "Local account and member of Administrators group". "Local account" is more restrictive but may cause issues on servers such as systems that provide Failover Clustering. -Microsoft Security Advisory Patch 2871997 adds the new security groups to Windows Server 2012. - - - SeDebugPrivilege +Microsoft Security Advisory Patch 2871997 adds the new security groups to Windows Server 2012. + + + SeDebugPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Debug programs" user right can attach a debugger to any process or to the kernel, providing complete access to sensitive and critical operating system components. This right is given to Administrators in the default configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Debug programs - - True - Administrators - False - False - +Accounts with the "Debug programs" user right can attach a debugger to any process or to the kernel, providing complete access to sensitive and critical operating system components. This right is given to Administrators in the default configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Debug programs + + True + Administrators + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -7523,40 +7506,40 @@ Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). - - - SeTrustedCredManAccessPrivilege +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). + + + SeTrustedCredManAccessPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Access Credential Manager as a trusted caller" user right may be able to retrieve the credentials of other accounts from Credential Manager.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Access Credential Manager as a trusted caller - - True - NULL - False - False - +Accounts with the "Access Credential Manager as a trusted caller" user right may be able to retrieve the credentials of other accounts from Credential Manager.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Access Credential Manager as a trusted caller + + True + NULL + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. -If any accounts or groups are granted the "Access Credential Manager as a trusted caller" user right, this is a finding. - - - SeNetworkLogonRight +If any accounts or groups are granted the "Access Credential Manager as a trusted caller" user right, this is a finding. + + + SeNetworkLogonRight <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Access this computer from the network" user right may access resources on the system, and must be limited to those that require it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Access this computer from the network - - True - Administrators,Authenticated Users - False - False - +Accounts with the "Access this computer from the network" user right may access resources on the system, and must be limited to those that require it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Access this computer from the network + + True + Administrators,Authenticated Users + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -7574,20 +7557,20 @@ Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. -The application account must meet requirements for application account passwords, such as length (V-36661) and required changes frequency (V-36662). - - - SeInteractiveLogonRight +The application account must meet requirements for application account passwords, such as length (V-36661) and required changes frequency (V-36662). + + + SeInteractiveLogonRight <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Allow log on locally" user right can log on interactively to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Allow log on locally - - True - Administrators - False - False - +Accounts with the "Allow log on locally" user right can log on interactively to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Allow log on locally + + True + Administrators + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -7604,20 +7587,20 @@ Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). - - - SeRemoteInteractiveLogonRight +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). + + + SeRemoteInteractiveLogonRight <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Allow log on through Remote Desktop Services" user right can access a system through Remote Desktop.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Allow log on through Remote Desktop Services - - True - Administrators - False - False - +Accounts with the "Allow log on through Remote Desktop Services" user right can access a system through Remote Desktop.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Allow log on through Remote Desktop Services + + True + Administrators + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -7629,20 +7612,20 @@ Administrators If the system serves the Remote Desktop Services role, the Remote Desktop Users group or another more restrictive group may be included. -Organizations may grant this to other groups, such as more restrictive groups with administrative or management functions, if required. Remote Desktop Services access must be restricted to the accounts that require it. This must be documented with the ISSO. - - - SeBackupPrivilege +Organizations may grant this to other groups, such as more restrictive groups with administrative or management functions, if required. Remote Desktop Services access must be restricted to the accounts that require it. This must be documented with the ISSO. + + + SeBackupPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Back up files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Back up files and directories - - True - Administrators - False - False - +Accounts with the "Back up files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Back up files and directories + + True + Administrators + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -7659,20 +7642,20 @@ Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). - - - SeCreatePagefilePrivilege +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). + + + SeCreatePagefilePrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Create a pagefile" user right can change the size of a pagefile, which could affect system performance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Create a pagefile - - True - Administrators - False - False - +Accounts with the "Create a pagefile" user right can change the size of a pagefile, which could affect system performance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Create a pagefile + + True + Administrators + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -7681,20 +7664,20 @@ Navigate to Local Computer Policy >> Computer Configuration >> Windo If any accounts or groups other than the following are granted the "Create a pagefile" user right, this is a finding: -Administrators - - - SeCreateTokenPrivilege +Administrators + + + SeCreateTokenPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -The "Create a token object" user right allows a process to create an access token. This could be used to provide elevated rights and compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Create a token object - - True - NULL - False - False - +The "Create a token object" user right allows a process to create an access token. This could be used to provide elevated rights and compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Create a token object + + True + NULL + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -7709,20 +7692,20 @@ Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). - - - SeCreateGlobalPrivilege +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). + + + SeCreateGlobalPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Create global objects" user right can create objects that are available to all sessions, which could affect processes in other users' sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Create global objects - - True - Administrators,Service,Local Service,Network Service - False - False - +Accounts with the "Create global objects" user right can create objects that are available to all sessions, which could affect processes in other users' sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Create global objects + + True + Administrators,Service,Local Service,Network Service + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -7742,40 +7725,40 @@ Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). - - - SeCreatePermanentPrivilege +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). + + + SeCreatePermanentPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Create permanent shared objects" user right could expose sensitive data by creating shared objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Create permanent shared objects - - True - NULL - False - False - +Accounts with the "Create permanent shared objects" user right could expose sensitive data by creating shared objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Create permanent shared objects + + True + NULL + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. -If any accounts or groups are granted the "Create permanent shared objects" user right, this is a finding. - - - SeCreateSymbolicLinkPrivilege +If any accounts or groups are granted the "Create permanent shared objects" user right, this is a finding. + + + SeCreateSymbolicLinkPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Create symbolic links" user right can create pointers to other objects, which could potentially expose the system to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Create symbolic links - - True - - False - True - '{0}' -match '^(Administrators,NT Virtual Machine\\Virtual Machines|Administrators)$' +Accounts with the "Create symbolic links" user right can create pointers to other objects, which could potentially expose the system to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Create symbolic links + + True + + False + True + '{0}' -match '^(Administrators,NT Virtual Machine\\Virtual Machines|Administrators)$' Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -7786,24 +7769,24 @@ If any accounts or groups other than the following are granted the "Create symbo Administrators -Systems that have the Hyper-V role will also have "Virtual Machines" given this user right (this may be displayed as "NT Virtual Machine\Virtual Machines"). This is not a finding. - - - SeDenyBatchLogonRight +Systems that have the Hyper-V role will also have "Virtual Machines" given this user right (this may be displayed as "NT Virtual Machine\Virtual Machines"). This is not a finding. + + + SeDenyBatchLogonRight <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Deny log on as a batch job" user right defines accounts that are prevented from logging on to the system as a batch job such, as Task Scheduler. In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain. -The Guests group must be assigned to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Deny log on as a batch job - - False - Enterprise Admins,Domain Admins,Guests - False - False - +The Guests group must be assigned to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Deny log on as a batch job + + False + Enterprise Admins,Domain Admins,Guests + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -7816,24 +7799,24 @@ Enterprise Admins Group Domain Admins Group All Systems: -Guests Group - - - SeDenyServiceLogonRight +Guests Group + + + SeDenyServiceLogonRight <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Deny log on as a service" user right defines accounts that are denied log on as a service. In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain. -Incorrect configurations could prevent services from starting and result in a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Deny log on as a service - - True - Enterprise Admins,Domain Admins - False - False - +Incorrect configurations could prevent services from starting and result in a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Deny log on as a service + + True + Enterprise Admins,Domain Admins + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -7844,24 +7827,24 @@ If the following accounts or groups are not defined for the "Deny log on as a se Enterprise Admins Group Domain Admins Group -If any accounts or groups are defined for the "Deny log on as a service" user right on non-domain-joined systems, this is a finding. - - - SeDenyInteractiveLogonRight +If any accounts or groups are defined for the "Deny log on as a service" user right on non-domain-joined systems, this is a finding. + + + SeDenyInteractiveLogonRight <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Deny log on locally" user right defines accounts that are prevented from logging on interactively. In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks which could lead to the compromise of an entire domain. -The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Deny log on locally - - False - Enterprise Admins,Domain Admins,Guests - False - False - +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Deny log on locally + + False + Enterprise Admins,Domain Admins,Guests + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -7875,10 +7858,10 @@ Enterprise Admins Group Domain Admins Group All Systems: -Guests Group - - - SeDenyRemoteInteractiveLogonRight +Guests Group + + + SeDenyRemoteInteractiveLogonRight <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. The "Deny log on through Remote Desktop Services" user right defines the accounts that are prevented from logging on using Remote Desktop Services. @@ -7887,14 +7870,14 @@ In an Active Directory Domain, denying logons to the Enterprise Admins and Domai Local accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks. -The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Deny log on through Remote Desktop Services - - False - Enterprise Admins,Domain Admins,Local account,Guests - False - False - +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Deny log on through Remote Desktop Services + + False + Enterprise Admins,Domain Admins,Local account,Guests + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -7912,39 +7895,39 @@ All Systems: Guests group Note: Windows Server 2012 R2 added new built-in security groups, including "Local account", for assigning permissions and rights to all local accounts. -Microsoft Security Advisory Patch 2871997 adds the new security groups to Windows Server 2012. - - - SeEnableDelegationPrivilege +Microsoft Security Advisory Patch 2871997 adds the new security groups to Windows Server 2012. + + + SeEnableDelegationPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -The "Enable computer and user accounts to be trusted for delegation" user right allows the "Trusted for Delegation" setting to be changed. This could potentially allow unauthorized users to impersonate other users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Enable computer and user accounts to be trusted for delegation - - True - NULL - False - False - +The "Enable computer and user accounts to be trusted for delegation" user right allows the "Trusted for Delegation" setting to be changed. This could potentially allow unauthorized users to impersonate other users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Enable computer and user accounts to be trusted for delegation + + True + NULL + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment. -If any accounts or groups are granted the "Enable computer and user accounts to be trusted for delegation" user right, this is a finding. - - - SeRemoteShutdownPrivilege +If any accounts or groups are granted the "Enable computer and user accounts to be trusted for delegation" user right, this is a finding. + + + SeRemoteShutdownPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Force shutdown from a remote system" user right can remotely shut down a system, which could result in a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Force shutdown from a remote system - - True - Administrators - False - False - +Accounts with the "Force shutdown from a remote system" user right can remotely shut down a system, which could result in a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Force shutdown from a remote system + + True + Administrators + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -7953,20 +7936,20 @@ Navigate to Local Computer Policy >> Computer Configuration >> Windo If any accounts or groups other than the following are granted the "Force shutdown from a remote system" user right, this is a finding: -Administrators - - - SeAuditPrivilege +Administrators + + + SeAuditPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -The "Generate security audits" user right specifies users and processes that can generate Security Log audit records, which must only be the system service accounts defined.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Generate security audits - - True - Local Service,Network Service - False - False - +The "Generate security audits" user right specifies users and processes that can generate Security Log audit records, which must only be the system service accounts defined.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Generate security audits + + True + Local Service,Network Service + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -7984,20 +7967,20 @@ Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). - - - SeImpersonatePrivilege +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). + + + SeImpersonatePrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -The "Impersonate a client after authentication" user right allows a program to impersonate another user or account to run on their behalf. An attacker could potentially use this to elevate privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Impersonate a client after authentication - - True - Administrators,Service,Local Service,Network Service - False - False - +The "Impersonate a client after authentication" user right allows a program to impersonate another user or account to run on their behalf. An attacker could potentially use this to elevate privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Impersonate a client after authentication + + True + Administrators,Service,Local Service,Network Service + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -8017,20 +8000,20 @@ Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). - - - SeIncreaseBasePriorityPrivilege +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). + + + SeIncreaseBasePriorityPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Increase scheduling priority" user right can change a scheduling priority causing performance issues or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Increase scheduling priority - - True - Administrators - False - False - +Accounts with the "Increase scheduling priority" user right can change a scheduling priority causing performance issues or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Increase scheduling priority + + True + Administrators + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -8047,20 +8030,20 @@ Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). - - - SeLoadDriverPrivilege +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). + + + SeLoadDriverPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -The "Load and unload device drivers" user right allows device drivers to dynamically be loaded on a system by a user. This could potentially be used to install malicious code by an attacker.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Load and unload device drivers - - True - Administrators - False - False - +The "Load and unload device drivers" user right allows device drivers to dynamically be loaded on a system by a user. This could potentially be used to install malicious code by an attacker.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Load and unload device drivers + + True + Administrators + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -8069,20 +8052,20 @@ Navigate to Local Computer Policy >> Computer Configuration >> Windo If any accounts or groups other than the following are granted the "Load and unload device drivers" user right, this is a finding: -Administrators - - - SeLockMemoryPrivilege +Administrators + + + SeLockMemoryPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -The "Lock pages in memory" user right allows physical memory to be assigned to processes, which could cause performance issues or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Lock pages in memory - - True - NULL - False - False - +The "Lock pages in memory" user right allows physical memory to be assigned to processes, which could cause performance issues or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Lock pages in memory + + True + NULL + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -8097,20 +8080,20 @@ Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). - - - SeSecurityPrivilege +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). + + + SeSecurityPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Manage auditing and security log" user right can manage the security log and change auditing configurations. This could be used to clear evidence of tampering.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Manage auditing and security log - - True - Administrators - False - False - +Accounts with the "Manage auditing and security log" user right can manage the security log and change auditing configurations. This could be used to clear evidence of tampering.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Manage auditing and security log + + True + Administrators + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -8129,20 +8112,20 @@ Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). - - - SeSystemEnvironmentPrivilege +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). + + + SeSystemEnvironmentPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Modify firmware environment values" user right can change hardware configuration environment variables. This could result in hardware failures or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Modify firmware environment values - - True - Administrators - False - False - +Accounts with the "Modify firmware environment values" user right can change hardware configuration environment variables. This could result in hardware failures or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Modify firmware environment values + + True + Administrators + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -8151,20 +8134,20 @@ Navigate to Local Computer Policy >> Computer Configuration >> Windo If any accounts or groups other than the following are granted the "Modify firmware environment values" user right, this is a finding: -Administrators - - - SeManageVolumePrivilege +Administrators + + + SeManageVolumePrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Perform volume maintenance tasks" user right can manage volume and disk configurations. They could potentially delete volumes, resulting in data loss or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Perform volume maintenance tasks - - True - Administrators - False - False - +Accounts with the "Perform volume maintenance tasks" user right can manage volume and disk configurations. They could potentially delete volumes, resulting in data loss or a DoS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Perform volume maintenance tasks + + True + Administrators + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -8173,20 +8156,20 @@ Navigate to Local Computer Policy >> Computer Configuration >> Windo If any accounts or groups other than the following are granted the "Perform volume maintenance tasks" user right, this is a finding: -Administrators - - - SeProfileSingleProcessPrivilege +Administrators + + + SeProfileSingleProcessPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Profile single process" user right can monitor nonsystem processes performance. An attacker could potentially use this to identify processes to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Profile single process - - True - Administrators - False - False - +Accounts with the "Profile single process" user right can monitor nonsystem processes performance. An attacker could potentially use this to identify processes to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Profile single process + + True + Administrators + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -8195,20 +8178,20 @@ Navigate to Local Computer Policy >> Computer Configuration >> Windo If any accounts or groups other than the following are granted the "Profile single process" user right, this is a finding: -Administrators - - - SeRestorePrivilege +Administrators + + + SeRestorePrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Restore files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data. It could also be used to overwrite more current data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Restore files and directories - - True - Administrators - False - False - +Accounts with the "Restore files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data. It could also be used to overwrite more current data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Restore files and directories + + True + Administrators + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -8225,20 +8208,20 @@ Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). - - - SeTakeOwnershipPrivilege +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). + + + SeTakeOwnershipPrivilege <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. -Accounts with the "Take ownership of files or other objects" user right can take ownership of objects and make changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - Take ownership of files or other objects - - True - Administrators - False - False - +Accounts with the "Take ownership of files or other objects" user right can take ownership of objects and make changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Take ownership of files or other objects + + True + Administrators + False + False + Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". @@ -8255,20 +8238,20 @@ Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. -The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). - - - - +The application account must meet requirements for application account passwords, such as length (WN12-00-000010) and required frequency of changes (WN12-00-000011). + + + + <VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant. -Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Absent - False - SMB1Protocol - False - +Disabling SMBv1 support may prevent access to file or print sharing resources with systems or devices that only support SMBv1. File shares and print services hosted on Windows Server 2003 are an example, however Windows Server 2003 is no longer a supported operating system. Some older network attached devices may only support SMBv1.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + SMB1Protocol + False + This requirement applies to Windows 2012 R2, it is NA for Windows 2012 (see V-73519 and V-73523 for 2012 requirements). Different methods are available to disable SMBv1 on Windows 2012 R2. This is the preferred method, however if V-73519 and V-73523 are configured, this is NA. @@ -8283,16 +8266,16 @@ Alternately: Search for "Features". Select "Turn Windows features on or off". -If "SMB 1.0/CIFS File Sharing Support" is selected, this is a finding. - - - <VulnDiscussion>Windows PowerShell versions 4.0 (with a patch) and 5.x add advanced logging features that can provide additional detail when malware has been run on a system. Ensuring Windows PowerShell 2.0 is not installed as well mitigates against a downgrade attack that evades the advanced logging features of later Windows PowerShell versions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - Absent - False - PowerShell-v2 - False - +If "SMB 1.0/CIFS File Sharing Support" is selected, this is a finding. + + + <VulnDiscussion>Windows PowerShell versions 4.0 (with a patch) and 5.x add advanced logging features that can provide additional detail when malware has been run on a system. Ensuring Windows PowerShell 2.0 is not installed as well mitigates against a downgrade attack that evades the advanced logging features of later Windows PowerShell versions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + PowerShell-v2 + False + Windows PowerShell 2.0 is not installed by default. Open "Windows PowerShell". @@ -8301,7 +8284,7 @@ Enter "Get-WindowsFeature -Name PowerShell-v2". If "Installed State" is "Installed", this is a finding. -An Installed State of "Available" or "Removed" is not a finding. - - - +An Installed State of "Available" or "Removed" is not a finding. + + + From 1486036dbda42b030fab89b3dbff33b961958fd2 Mon Sep 17 00:00:00 2001 From: Brian Wilhite Date: Wed, 20 Nov 2019 11:58:29 -0500 Subject: [PATCH 06/42] updated to successfully parse Win10 V1R19 (#534) --- CHANGELOG.md | 1 + ..._MS_Windows_10_STIG_V1R17_Manual-xccdf.xml | 13595 ---------------- ...MS_Windows_10_STIG_V1R19_Manual-xccdf.log} | 1 + ..._MS_Windows_10_STIG_V1R19_Manual-xccdf.xml | 4485 +++++ ... => WindowsClient-10-1.19.org.default.xml} | 6 +- ...-10-1.17.xml => WindowsClient-10-1.19.xml} | 210 +- 6 files changed, 4606 insertions(+), 13692 deletions(-) delete mode 100644 StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R17_Manual-xccdf.xml rename StigData/Archive/Windows.Client/{U_MS_Windows_10_STIG_V1R17_Manual-xccdf.log => U_MS_Windows_10_STIG_V1R19_Manual-xccdf.log} (70%) create mode 100644 StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R19_Manual-xccdf.xml rename StigData/Processed/{WindowsClient-10-1.17.org.default.xml => WindowsClient-10-1.19.org.default.xml} (95%) rename StigData/Processed/{WindowsClient-10-1.17.xml => WindowsClient-10-1.19.xml} (97%) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4c1864084..b7c3c3c8c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ * Fixed [#427](https://github.com/microsoft/PowerStig/issues/427): Windows 10 Rule V-63373 fails to apply settings to system drive * Fixed [#514](https://github.com/microsoft/PowerStig/issues/514): Feature request: additional support for servicerule properties * Fixed [#521](https://github.com/microsoft/PowerStig/issues/521): Organizational setting warning should include Stig name +* Update PowerSTIG to successfully parse Microsoft Windows 10 STIG - Ver 1, Rel 19: [533](https://github.com/microsoft/PowerStig/issues/533) * Update PowerSTIG to parse/convert the Windows Server 2012 R2 MS/DC V2R17/V2R18 Respectively: [531](https://github.com/microsoft/PowerStig/issues/531) ## 4.1.1 diff --git a/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R17_Manual-xccdf.xml b/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R17_Manual-xccdf.xml deleted file mode 100644 index 3ad369e31..000000000 --- a/StigData/Archive/Windows.Client/U_MS_Windows_10_STIG_V1R17_Manual-xccdf.xml +++ /dev/null @@ -1,13595 +0,0 @@ - - - accepted - Windows 10 Security Technical Implementation Guide - The Windows 10 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil. - Developed_by_DISA_for_the_DoD - - DISA - STIG.DOD.MIL - - Release: 17 Benchmark Date: 24 May 2019 - 1 - - I - Mission Critical Classified - <ProfileDescription></ProfileDescription> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - I - Mission Critical Sensitive - <ProfileDescription></ProfileDescription> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - II - Mission Support Public - <ProfileDescription></ProfileDescription> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - III - Administrative Classified - <ProfileDescription></ProfileDescription> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - III - Administrative Sensitive - <ProfileDescription></ProfileDescription> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - I - Mission Critical Public<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>DTBG010 - DoD Root Certificate is not installed<GroupDescription></GroupDescription>DTBG010The DOD Root Certificate is not installed.<VulnDiscussion>The DOD root certificate will ensure that the trust chain is established for server certificate issued from the DOD CA.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Officer</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-000185Install the DOD root certificates.Navigate to Tools >> Options >> Advanced >> Certificates tab >> View Certificates button. On the Certificate Manager window, select the "Authorities" tab. Scroll through the Certificate Name list to the U.S. Government heading. Look for the entries for DoD Root CA 2, DoD Root CA 3, and DoD Root CA 4. + +If there are entries for DoD Root CA 2, DoD Root CA 3, and DoD Root CA 4, select them individually. + +Click the "View" button. + +Verify the publishing organization is "US Government." + +If there are no entries for the DoD Root CA 2, DoD Root CA 3, and DoD Root CA 4, this is a finding. + +Note: In a Windows environment, use of policy setting "security.enterprise_roots.enabled=true" will point Firefox to the Windows Trusted Root Certification Authority Store, this is not a finding.FireFox Preferences – Verification<GroupDescription></GroupDescription>DTBF050FireFox is configured to ask which certificate to present to a web site when a certificate is required.<VulnDiscussion>When a web site asks for a certificate for user authentication, Firefox must be configured to have the user choose which certificate to present. Websites within DOD require user authentication for access which increases security for DoD information. Access will be denied to the user if certificate management is not configured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-001274Set the value of "security.default_personal_cert" to "Ask Every Time". Use the Mozilla.cfg file to lock the preference so users cannot change it. + +Type "about:config" in the browser address bar. Verify Preference Name "security.default_personal_cert" is set to "Ask Every Time" and is locked to prevent the user from altering. + +Criteria: If the value of "security.default_personal_cert" is set incorrectly or is not locked, then this is a finding. +DTBF100 -FireFox Preferences–auto-download actions<GroupDescription></GroupDescription>DTBF100Firefox automatically executes or downloads MIME types which are not authorized for auto-download.<VulnDiscussion>The default action for file types for which a plugin is installed is to automatically download and execute the file using the associated plugin. Firefox allows you to change the specified download action so that the file is opened with a selected external application or saved to disk instead. View the list of installed browser plugins and related MIME types by entering about:plugins in the address bar. + +When you click a link to download a file, the MIME type determines what action Firefox will take. You may already have a plugin installed that will automatically handle the download, such as Windows Media Player or QuickTime. Other times, you may see a dialog asking whether you want to save the file or open it with a specific application. When you tell Firefox to open or save the file and also check the option to "Do this automatically for files like this from now on", an entry appears for that type of file in the Firefox Applications panel, shown below. +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-001242Remove any unauthorized extensions from the autodownload list. Use Method 1 or 2 to check if the following extensions are listed in the browser configuration: HTA, JSE, JS, MOCHA, SHS, VBE, VBS, SCT, WSC. By default, most of these extensions will not show up on the Firefox listing. + +Criteria: + +Method 1: In about:plugins, Installed plug-in, inspect the entries in the Suffixes column. + +If any of the prohibited extensions are found, then for each of them, verify that it is not associated with an application that executes code. However, applications such as Notepad.exe that do not execute code may be associated with the extension. If the extension is associated with an unauthorized application, then this is a finding. + +If the extension exists but is not associated with an application, then this is a finding. + +Method 2: +Use the Options User Interface Applications menu to search for the prohibited extensions in the Content column of the table. + +If an extension that is not approved for automatic execution exists and the entry in the Action column is associated with an application that does not execute the code (e.g., Notepad), then do not mark this as a finding. + +If the entry exists and the "Action" is 'Save File' or 'Always Ask', then this is not a finding. + +If an extension exists and the entry in the Action column is associated with an application that does/can execute the code, then this is a finding. +DTBF105 - FireFox Preferences – Shell Protocol<GroupDescription></GroupDescription>DTBF105Network shell protocol is enabled in FireFox.<VulnDiscussion>Although current versions of Firefox have this set to disabled by default, use of this option can be harmful. This would allow the browser to access the Windows shell. This could allow access to the +underlying system. This check verifies that the default setting has not been changed. +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-000381Procedure: Set the value of "network.protocol-handler.external.shell" to "false" and lock using the Mozilla.cfg file.Procedure: Open a browser window, type "about:config" in the address bar. + +Criteria: If the value of "network.protocol-handler.external.shell" is not "false" or is not locked, then this is a finding. DTBF110 - FireFox Preferences – Open Confirmation<GroupDescription></GroupDescription>DTBF110Firefox is not configured to prompt a user before downloading and opening required file types.<VulnDiscussion>New file types cannot be added directly to the helper applications or plugins listing. Files with these extensions will not be allowed to use Firefox publicly available plugins and extensions to open. The application will be configured to open these files using external applications only. After a helper application or save to disk download action has been set, that action will be taken automatically for those types of files. When the user receives a dialog box asking if you want to save the file or open it with a specified application, this indicates that a plugin does not exist. The user has not previously selected a download action or helper application to automatically use for that type of file. When prompted, if the user checks the option to Do this automatically for files like this from now on, then an entry will appear for that type of file in the plugins listing and this file type is automatically opened in the future. This can be a security issue. New file types cannot be added directly to the Application plugin listing. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-001243Ensure the following extensions are not automatically opened by Firefox without user confirmation. Do not use plugins and add-ons to open these files. +Use the "plugin.disable_full_page_plugin_for_types" preference to set and lock the following extensions so that an external application, rather than an add-on or plugin, will not be used: +PDF, FDF, XFDF, LSL, LSO, LSS, IQY, RQY, XLK, XLS, XLT, POT, PPS, PPT, DOS, DOT, WKS, BAT, PS, EPS, WCH, WCM, WB1, WB3, RTF, DOC, MDB, MDE, WBK, WB1, WCH, WCM, AD, ADP.Open a browser window, type "about:config" in the address bar. +Criteria: If the “plugin.disable_full_page_plugin_for_types” value is not set to include the following external extensions and not locked, this is a finding: +PDF, FDF, XFDF, LSL, LSO, LSS, IQY, RQY, XLK, XLS, XLT, POT, PPS, PPT, DOS, DOT, WKS, BAT, PS, EPS, WCH, WCM, WB1, WB3, RTF, DOC, MDB, MDE, WBK, WB1, WCH, WCM, AD, ADP.DTBF120 - FireFox Preferences – ActiveX controls<GroupDescription></GroupDescription>DTBF120FireFox plug-in for ActiveX controls is installed.<VulnDiscussion>When an ActiveX control is referenced in an HTML document, MS Windows checks to see if +the control already resides on the client machine. If not, the control can be downloaded from a +remote web site. This provides an automated delivery method for mobile code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-001170Remove/uninstall the Mozilla ActiveX plugin Open a browser window, type "about:plugins" in the address bar. + +Criteria: If the Mozilla ActiveX control and plugin support is present and enabled, then this is a finding. +DTBF140 - FireFox Preferences – Autofill forms<GroupDescription></GroupDescription>DTBF140Firefox formfill assistance option is disabled.<VulnDiscussion>In order to protect privacy and sensitive data, Firefox provides the ability to configure Firefox such that data entered into forms is not saved. This mitigates the risk of a website gleaning private information from prefilled information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-000381Ensure the preference “browser.formfill.enable" is set and locked to the value of “false”.Type "about:config" in the address bar, verify that the preference name “browser.formfill.enable" is set to “false” and locked. + +Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding. +DTBF150 - FireFox Preferences – Autofill passwords<GroupDescription></GroupDescription>DTBF150Firefox is configured to autofill passwords.<VulnDiscussion>While on the internet, it may be possible for an attacker to view the saved password files and gain access to the user's accounts on various hosts. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-000381Ensure the preference "signon.autofillForms" is set and locked to the value of “false”.In About:Config, verify that the preference name “signon.autofillForms“ is set to “false” and locked. +Criteria: If the parameter is set incorrectly, this is a finding. +If the setting is not locked, this is a finding.DTBF160 - FireFox Preferences – Password store<GroupDescription></GroupDescription>DTBF160FireFox is configured to use a password store with or without a master password.<VulnDiscussion>Firefox can be set to store passwords for sites visited by the user. These individual passwords are stored in a file and can be protected by a master password. Autofill of the password can then be enabled when the site is visited. This feature could also be used to autofill the certificate pin which could lead to compromise of DoD information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-000381Ensure the preference “signon.rememberSignons“ is set and locked to the value of “false”.Type "about:config" in the browser window. Verify that the preference name “signon.rememberSignons" is set and locked to “false”. + +Criteria: If the parameter is set incorrectly, then this is a finding. + +If the setting is not locked, then this is a finding.DTBF180 - Pop-up windows<GroupDescription></GroupDescription>DTBF180FireFox is not configured to block pop-up windows.<VulnDiscussion>Popup windows may be used to launch an attack within a new browser window with altered settings. This setting blocks popup windows created while the page is loading.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-000381Ensure the preference "dom.disable_window_open_feature.status " is set and locked to the value of “true”.In About:Config, verify that the preference name “dom.disable_window_open_feature.status " is set to “true” and locked. + +Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding. +DTBF181 - JavaScript move or resize windows<GroupDescription></GroupDescription>DTBF181FireFox is configured to allow JavaScript to move or resize windows. +<VulnDiscussion>JavaScript can make changes to the browser’s appearance. This activity can help disguise an attack taking place in a minimized background window. Set browser setting to prevent scripts on visited websites from moving and resizing browser windows. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-000381Ensure the preference "dom.disable_window_move_resize" is set and locked to the value of “true”.In About:Config, verify that the preference name “dom.disable_window_move_resize" is set and locked to “true”. + +Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding. +DTBF030 - Firefox Preferences TLS Protocols<GroupDescription></GroupDescription>DTBF030Firefox must be configured to allow only TLS.<VulnDiscussion>Use of versions prior to TLS 1.1 are not permitted. SSL 2.0 and SSL 3.0 contain a number of security flaws. These versions must be disabled in compliance with the Network Infrastructure and Secure Remote Computing STIGs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-002450Configure the following parameters using the Mozilla.cfg file: + +LockPref "security.tls.version.min" is set to "2". +LockPref "security.tls.version.max" is set to "3".Open a browser window, type "about:config" in the address bar. + +Verify Preference Name "security.tls.version.min" is set to the value "2" and locked. +Verify Preference Name "security.tls.version.max" is set to the value "3" and locked. + +Criteria: If the parameters are set incorrectly, this is a finding. + +If the settings are not locked, this is a finding.DTBF182 - JavaScript raise or lower windows<GroupDescription></GroupDescription>DTBF182Firefox is configured to allow JavaScript to raise or lower windows.<VulnDiscussion>JavaScript can make changes to the browser’s appearance. Allowing a website to use JavaScript to raise and lower browser windows may disguise an attack. Browser windows may not be set as active via JavaScript. +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-000381Ensure the preference "dom.disable_window_flip" is set and locked to the value of “true”.In About:Config, verify that the preference name “dom.disable_window_flip" is set and locked to “true”. + +Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding.DTBF183 - JavaScript Context Menus<GroupDescription></GroupDescription>DTBF183Firefox is configured to allow JavaScript to disable or replace context menus.<VulnDiscussion>A context menu (also known as a pop-up menu) is often used in a graphical user interface (GUI) and appears upon user interaction (e.g., a right mouse click). A context menu offers a limited set of choices that are available in the current state, or context, of the operating system or application. A website may execute JavaScript that can make changes to these context menus. This can help disguise an attack. Set this preference to "false" so that webpages will not be able to affect the context menu event.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-000381Ensure the preferences "dom.event.contextmenu.enabled" is set and locked to "false".Type "about:config" in the address bar of the browser. + +Verify that the preferences "dom.event.contextmenu.enabled" is set and locked to "false". + +Criteria: If the parameter is set incorrectly, then this is a finding. + +If the setting is not locked, this is a finding.DTBF003 - Installed version of Firefox not supported<GroupDescription></GroupDescription>DTBF003Installed version of Firefox unsupported.<VulnDiscussion>Use of versions of an application which are not supported by the vendor are not permitted. Vendors respond to security flaws with updates and patches. These updates are not available for unsupported version which can leave the application vulnerable to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-003376Upgrade the version of the browser to an approved version by obtaining software from the vendor or other trusted source.Method 1: View the following registry key: +HKLM\Software\Mozilla\Mozilla Firefox\CurrentVersion + +Method 2: Run Firefox. Click the ellipsis button >> Help >> About Firefox, and view the version number. + +Criteria: If the Firefox version is not a supported version, this is a finding.DTBF090-Firefox Preferences-Addons\ plugin updates<GroupDescription></GroupDescription>DTBF090Firefox automatically updates installed add-ons and plugins.<VulnDiscussion>Set this to false to disable checking for updated versions of the Extensions/Themes. Automatic updates from untrusted sites puts the enclave at risk of attack and may override security settings.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-000381Set the preference “extensions.update.enabled” value to "false" and lock using the Mozilla.cfg file. +Type "about:config" in the browser window. Verify the preference “extensions.update.enabled” is set to "false" and locked. + +Criteria: If the parameter is set incorrectly, then this is a finding. If this setting is not locked, then this is a finding. +DTBF070 - Firefox Preferences - Lock settings<GroupDescription></GroupDescription>DTBF070Firefox required security preferences cannot be changed by user.<VulnDiscussion>Locked settings prevent users from accessing about:config and changing the security settings set by the system administrator. Locked settings should be placed in the mozilla.cfg file. The mozilla.cfg file is an encoded file of JavaScript commands. The encoding is a simple "byte-shifting" with an offset of 13 (Netscape 4 used a similar encoding, but with a 7 instead). This file also needs to be "called" from the configuration file local-settings.js</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-000366Ensure the required settings in "about:config" are locked using the "mozilla.cfg" file.Verify that required settings are marked as locked in "about:config". +Verify that "mozilla.cfg" file is used to lock required security settings. +If settings are enable, and not locked, this is a finding. +Sample file: +// +lockPref("browser.download.dir", "N:"); +lockPref("browser.download.downloadDir", "N:"); +lockPref("app.update.enabled", false); +lockPref("extensions.update.enabled", false); +lockPref("browser.shell.checkDefaultBrowser", false); +lockPref("browser.search.update", false); +lockPref("dom.disable_open_during_load", true); +lockPref("dom.disable_window_move_resize", true); +lockPref("dom.event.contextmenu.enabled", false); +lockPref("dom.disable_window_status_change", true); +lockPref("security.warn_leaving_secure", true); +lockPref("security.default_personal_cert", "Ask Every Time"); +lockPref("signon.rememberSignons", false); +lockPref("xpinstall.whitelist.required", true); +lockPref(“network.protocol-handler.external.shell”,false); +Note: Append line into local-settings.js file to include in the Mozilla config file.DTBF085 - Firefox Preferences –Search update <GroupDescription></GroupDescription>DTBF085Firefox automatically checks for updated version of installed Search plugins.<VulnDiscussion>Updates need to be controlled and installed from authorized and trusted servers. This setting overrides a number of other settings which may direct the application to access external URLs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls>ECSC-1</IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-000381Ensure the preference "browser.search.update" is set and locked to the value of “False”.Type "about:config" in the browser window. Verify the preference "browser.search.update” is set to "false" and locked. + +Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding. +DTBF186 - Extensions<GroupDescription></GroupDescription>DTBF186Extensions install must be disabled.<VulnDiscussion>A browser extension is a program that has been installed into the browser which adds functionality to it. Where a plug-in interacts only with a web page and usually a third party external application (Flash, Adobe Reader) an extension interacts with the browser program itself. Extensions are not embedded in web pages and must be downloaded and installed in order to work. Extensions allow browsers to avoid restrictions which apply to web pages. For example, an extension can be written to combine data from multiple domains and present it when a certain page is accessed which can be considered Cross Site Scripting. If a browser is configured to allow unrestricted use of extension then plug-ins can be loaded and installed from malicious sources and used on the browser.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-000381Set the preference “xpinstall.enabled” to “false” and lock using the “mozilla.cfg” file. The “mozilla.cfg” file may need to be created if it does not already exist.Open a browser window, type "about:config" in the address bar, then navigate to the setting for Preference Name "xpinstall.enabled" and set the value to “false” and locked. + +Criteria: If the value of “xpinstall.enabled” is “false”, this is not a finding. + +If the value is locked, this is not a finding. +DTBF190 - Background data submission<GroupDescription></GroupDescription>DTBF190Background submission of information to Mozilla must be disabled.<VulnDiscussion>There should be no background submission of technical and other information from DoD computers to Mozilla with portions posted publically.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-000381Ensure the preferences "datareporting.policy.dataSubmissionEnabled" is set and locked to "false". +Ensure the preferences "datareporting.healthreport.service.enabled" is set and locked to "false". +Ensure the preferences "datareporting.healthreport.uploadEnabled" is set and locked to "false".Type "about:config" in the address bar of the browser. +Verify that the preference "datareporting.policy.dataSubmissionEnabled" is set and locked to "false". +Verify that the preference "datareporting.healthreport.service.enabled" is set and locked to "false". +Verify that the preference "datareporting.healthreport.uploadEnabled" is set and locked to "false". +Criteria: If the parameters are set incorrectly, this is a finding.DTBF195 - Extensions<GroupDescription></GroupDescription>DTBF195Firefox Development Tools Must Be Disabled.<VulnDiscussion>Information needed by an attacker to begin looking for possible vulnerabilities in a web browser includes any information about the web browser and plug-ins or modules being used. When debugging or trace information is enabled in a production web browser, information about the web browser, such as web browser type, version, patches installed, plug-ins and modules installed, type of code being used by the hosted application, and any back-ends being used for data storage may be displayed. Since this information may be placed in logs and general messages during normal operation of the web browser, an attacker does not need to cause an error condition to gain this information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target FirefoxDISADPMS TargetFirefox205CCI-001312Set the value of "devtools.policy.disabled" to "true" using the Mozilla.cfg file, or the registry value of HKLM\Software\Policies\Mozilla\Firefox\DisableDeveloperTools to “1”Procedure: Open a browser window, type "about:config" in the address bar. + +Criteria: If the value of "devtools.policy.disabled" is not "true", then this is a finding. diff --git a/StigData/Processed/FireFox-All-4.25.org.default.xml b/StigData/Processed/FireFox-All-4.27.org.default.xml similarity index 84% rename from StigData/Processed/FireFox-All-4.25.org.default.xml rename to StigData/Processed/FireFox-All-4.27.org.default.xml index f1ef5a9b5..ea9ad07c2 100644 --- a/StigData/Processed/FireFox-All-4.25.org.default.xml +++ b/StigData/Processed/FireFox-All-4.27.org.default.xml @@ -5,4 +5,4 @@ Each setting in this file is linked by STIG ID and the valid range is in an associated comment. --> - + diff --git a/StigData/Processed/FireFox-All-4.25.xml b/StigData/Processed/FireFox-All-4.27.xml similarity index 84% rename from StigData/Processed/FireFox-All-4.25.xml rename to StigData/Processed/FireFox-All-4.27.xml index e768c7c4a..3f1a87c14 100644 --- a/StigData/Processed/FireFox-All-4.25.xml +++ b/StigData/Processed/FireFox-All-4.27.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>When a web site asks for a certificate for user authentication, Firefox must be configured to have the user choose which certificate to present. Websites within DOD require user authentication for access which increases security for DoD information. Access will be denied to the user if certificate management is not configured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls> @@ -22,7 +22,7 @@ underlying system. This check verifies that the default setting has not been ch network.protocol-handler.external.shell False - Procedure: Open a browser window, type "about:config" in the address bar. + Procedure: Open a browser window, type "about:config" in the address bar. Criteria: If the value of "network.protocol-handler.external.shell" is not "false" or is not locked, then this is a finding. false @@ -31,11 +31,11 @@ Criteria: If the value of "network.protocol-handler.external.shell" is not "fals <VulnDiscussion>New file types cannot be added directly to the helper applications or plugins listing. Files with these extensions will not be allowed to use Firefox publicly available plugins and extensions to open. The application will be configured to open these files using external applications only. After a helper application or save to disk download action has been set, that action will be taken automatically for those types of files. When the user receives a dialog box asking if you want to save the file or open it with a specified application, this indicates that a plugin does not exist. The user has not previously selected a download action or helper application to automatically use for that type of file. When prompted, if the user checks the option to Do this automatically for files like this from now on, then an entry will appear for that type of file in the plugins listing and this file type is automatically opened in the future. This can be a security issue. New file types cannot be added directly to the Application plugin listing. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls> False - plugin.default_plugin_disabled + plugin.disable_full_page_plugin_for_types False Open a browser window, type "about:config" in the address bar. -Criteria: If the “plugin.default_plugin_disabled” value is not set to include the following external extensions and not locked, this is a finding: +Criteria: If the “plugin.disable_full_page_plugin_for_types” value is not set to include the following external extensions and not locked, this is a finding: PDF, FDF, XFDF, LSL, LSO, LSS, IQY, RQY, XLK, XLS, XLT, POT, PPS, PPT, DOS, DOT, WKS, BAT, PS, EPS, WCH, WCM, WB1, WB3, RTF, DOC, MDB, MDE, WBK, WB1, WCH, WCM, AD, ADP. PDF,FDF,XFDF,LSL,LSO,LSS,IQY,RQY,XLK,XLS,XLT,POT,PPS,PPT,DOS,DOT,WKS,BAT,PS,EPS,WCH,WCM,WB1,WB3,RTF,DOC,MDB,MDE,WBK,WB1,WCH,WCM,AD,ADP @@ -46,7 +46,7 @@ PDF, FDF, XFDF, LSL, LSO, LSS, IQY, RQY, XLK, XLS, XLT, POT, PPS, PPT, DOS, DOT, browser.formfill.enable False - Type "about:config" in the address bar, verify that the preference name “browser.formfill.enable" is set to “false” and locked. + Type "about:config" in the address bar, verify that the preference name “browser.formfill.enable" is set to “false” and locked. Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding. @@ -105,16 +105,6 @@ Criteria: If the parameter is set incorrectly, then this is a finding. If the s true - <VulnDiscussion>Use of versions prior to TLS 1.1 are not permitted. SSL 2.0 and SSL 3.0 contain a number of security flaws. These versions must be disabled in compliance with the Network Infrastructure and Secure Remote Computing STIGs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls> - - False - security.enable_tls - False - - Verify Preference Name "security.enable_tls" is set to the value "true" and locked. - true - - <VulnDiscussion>Use of versions prior to TLS 1.1 are not permitted. SSL 2.0 and SSL 3.0 contain a number of security flaws. These versions must be disabled in compliance with the Network Infrastructure and Secure Remote Computing STIGs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls> False @@ -124,7 +114,7 @@ Criteria: If the parameter is set incorrectly, then this is a finding. If the s Verify Preference Name "security.tls.version.min" is set to the value "2" and locked. 2 - + <VulnDiscussion>Use of versions prior to TLS 1.1 are not permitted. SSL 2.0 and SSL 3.0 contain a number of security flaws. These versions must be disabled in compliance with the Network Infrastructure and Secure Remote Computing STIGs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls> False @@ -163,31 +153,6 @@ Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, this is a finding. false - - <VulnDiscussion>When a user visits some webpages, JavaScript can hide or make changes to the browser’s appearance to hide unauthorized activity. This activity can help disguise an attack taking place in a minimized background window. Determines whether the text in the browser status bar may be set by JavaScript. Set and lock to True (default in Firefox) so that JavaScript access to preference settings for is disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls> - - False - dom.disable_window_status_change - False - - Type "about:config" in the address bar of the browser. Verify that the preference “dom.disable_window_status_change" is set and locked to “true”. - -Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding. - true - - - <VulnDiscussion>Users may not be aware that the information being viewed under secure conditions in a previous page are not currently being viewed under the same security settings. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls> - - False - security.warn_leaving_secure - False - - Type "about:config" in the browser window. Verify that the preference name “security.warn_leaving_secure" is set to “true” and locked. - -Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding. - - true - <VulnDiscussion>Set this to false to disable checking for updated versions of the Extensions/Themes. Automatic updates from untrusted sites puts the enclave at risk of attack and may override security settings.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls> @@ -195,9 +160,9 @@ Criteria: If the parameter is set incorrectly, then this is a finding. If the extensions.update.enabled False - Type "about:config" in the browser window. Verify the preference “extensions.update.enabled” is set to "false" and locked. + Type "about:config" in the browser window. Verify the preference “extensions.update.enabled” is set to "false" and locked. -Criteria: If the parameter is set incorrectly, then this is a finding. If this setting is not locked, then this is a finding. +Criteria: If the parameter is set incorrectly, then this is a finding. If this setting is not locked, then this is a finding. false @@ -208,14 +173,14 @@ Criteria: If the parameter is set incorrectly, then this is a finding. If this s browser.search.update False - Type "about:config" in the browser window. Verify the preference "browser.search.update” is set to "false" and locked. + Type "about:config" in the browser window. Verify the preference "browser.search.update” is set to "false" and locked. -Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding. +Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding. false - - <VulnDiscussion>A browser extension is a program that has been installed into the browser which adds functionality to it. Where a plug-in interacts only with a web page and usually a third party external application (Flash, Adobe Reader) an extension interacts with the browser program itself. Extensions are not embedded in web pages and must be downloaded and installed in order to work. Extensions allow browsers to avoid restrictions which apply to web pages. For example, a Chrome extension can be written to combine data from multiple domains and present it when a certain page is accessed which can be considered Cross Site Scripting. If a browser is configured to allow unrestricted use of extension then plug-ins can be loaded and installed from malicious sources and used on the browser. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls> + + <VulnDiscussion>A browser extension is a program that has been installed into the browser which adds functionality to it. Where a plug-in interacts only with a web page and usually a third party external application (Flash, Adobe Reader) an extension interacts with the browser program itself. Extensions are not embedded in web pages and must be downloaded and installed in order to work. Extensions allow browsers to avoid restrictions which apply to web pages. For example, an extension can be written to combine data from multiple domains and present it when a certain page is accessed which can be considered Cross Site Scripting. If a browser is configured to allow unrestricted use of extension then plug-ins can be loaded and installed from malicious sources and used on the browser.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls> False xpinstall.enabled @@ -259,6 +224,18 @@ If the value is locked, this is not a finding. Verify that the preference "datareporting.healthreport.uploadEnabled" is set and locked to "false". false + + <VulnDiscussion>Information needed by an attacker to begin looking for possible vulnerabilities in a web browser includes any information about the web browser and plug-ins or modules being used. When debugging or trace information is enabled in a production web browser, information about the web browser, such as web browser type, version, patches installed, plug-ins and modules installed, type of code being used by the hosted application, and any back-ends being used for data storage may be displayed. Since this information may be placed in logs and general messages during normal operation of the web browser, an attacker does not need to cause an error condition to gain this information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + devtools.policy.disabled + False + + Procedure: Open a browser window, type "about:config" in the address bar. + +Criteria: If the value of "devtools.policy.disabled" is not "true", then this is a finding. + true + @@ -280,7 +257,7 @@ If there are no entries for the DoD Root CA 2, DoD Root CA 3, and DoD Root CA 4, Note: In a Windows environment, use of policy setting "security.enterprise_roots.enabled=true" will point Firefox to the Windows Trusted Root Certification Authority Store, this is not a finding. - <VulnDiscussion>The default action for file types for which a plugin is installed is to automatically download and execute the file using the associated plugin. Firefox allows you to change the specified download action so that the file is opened with a selected external application or saved to disk instead. View the list of installed browser plugins and related MIME types by entering about:plugins in the address bar. + <VulnDiscussion>The default action for file types for which a plugin is installed is to automatically download and execute the file using the associated plugin. Firefox allows you to change the specified download action so that the file is opened with a selected external application or saved to disk instead. View the list of installed browser plugins and related MIME types by entering about:plugins in the address bar. When you click a link to download a file, the MIME type determines what action Firefox will take. You may already have a plugin installed that will automatically handle the download, such as Windows Media Player or QuickTime. Other times, you may see a dialog asking whether you want to save the file or open it with a specific application. When you tell Firefox to open or save the file and also check the option to "Do this automatically for files like this from now on", an entry appears for that type of file in the Firefox Applications panel, shown below. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls> @@ -288,23 +265,23 @@ When you click a link to download a file, the MIME type determines what action F False False - Use Method 1 or 2 to check if the following extensions are listed in the browser configuration: HTA, JSE, JS, MOCHA, SHS, VBE, VBS, SCT, WSC. By default, most of these extensions will not show up on the Firefox listing. + Use Method 1 or 2 to check if the following extensions are listed in the browser configuration: HTA, JSE, JS, MOCHA, SHS, VBE, VBS, SCT, WSC. By default, most of these extensions will not show up on the Firefox listing. -Criteria: +Criteria: -Method 1: In about:plugins, Installed plug-in, inspect the entries in the Suffixes column. +Method 1: In about:plugins, Installed plug-in, inspect the entries in the Suffixes column. If any of the prohibited extensions are found, then for each of them, verify that it is not associated with an application that executes code. However, applications such as Notepad.exe that do not execute code may be associated with the extension. If the extension is associated with an unauthorized application, then this is a finding. -If the extension exists but is not associated with an application, then this is a finding. +If the extension exists but is not associated with an application, then this is a finding. -Method 2: +Method 2: Use the Options User Interface Applications menu to search for the prohibited extensions in the Content column of the table. -If an extension that is not approved for automatic execution exists and the entry in the Action column is associated with an application that does not execute the code (e.g., Notepad), then do not mark this as a finding. +If an extension that is not approved for automatic execution exists and the entry in the Action column is associated with an application that does not execute the code (e.g., Notepad), then do not mark this as a finding. If the entry exists and the "Action" is 'Save File' or 'Always Ask', then this is not a finding. - + If an extension exists and the entry in the Action column is associated with an application that does/can execute the code, then this is a finding. @@ -327,12 +304,12 @@ Criteria: If the Mozilla ActiveX control and plugin support is present and enabl False False - Method 1: View the following registry key: + Method 1: View the following registry key: HKLM\Software\Mozilla\Mozilla Firefox\CurrentVersion -Method 2: Search for the firefox.exe file using the search feature of the operating system. Examine the files properties for the product version (not the file version). For Windows OS, determine the version of the file by examining navigating to Properties/Version/Product Version. Examine for all instances of firefox.exe that are present on the endpoint. +Method 2: Run Firefox. Click the ellipsis button >> Help >> About Firefox, and view the version number. -Criteria: If the FireFox version is not a supported Extended Service Release (ESR), this is a finding. +Criteria: If the Firefox version is not a supported version, this is a finding. <VulnDiscussion>Locked settings prevent users from accessing about:config and changing the security settings set by the system administrator. Locked settings should be placed in the mozilla.cfg file. The mozilla.cfg file is an encoded file of JavaScript commands. The encoding is a simple "byte-shifting" with an offset of 13 (Netscape 4 used a similar encoding, but with a 7 instead). This file also needs to be "called" from the configuration file local-settings.js</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><IAControls></IAControls> From 67cc280082c0ed98c6752e9139f8bc67a6ef047d Mon Sep 17 00:00:00 2001 From: Brian Wilhite Date: Wed, 20 Nov 2019 12:34:57 -0500 Subject: [PATCH 08/42] added support for IE 1.18 (#539) --- CHANGELOG.md | 1 + ... => U_MS_IE11_STIG_V1R18_Manual-xccdf.log} | 0 ... => U_MS_IE11_STIG_V1R18_Manual-xccdf.xml} | 100 ++++++++++-------- ... InternetExplorer-11-1.18.org.default.xml} | 2 +- ...-1.16.xml => InternetExplorer-11-1.18.xml} | 51 ++++----- 5 files changed, 79 insertions(+), 75 deletions(-) rename StigData/Archive/InternetExplorer/{U_MS_IE11_STIG_V1R16_Manual-xccdf.log => U_MS_IE11_STIG_V1R18_Manual-xccdf.log} (100%) rename StigData/Archive/InternetExplorer/{U_MS_IE11_STIG_V1R16_Manual-xccdf.xml => U_MS_IE11_STIG_V1R18_Manual-xccdf.xml} (69%) rename StigData/Processed/{InternetExplorer-11-1.16.org.default.xml => InternetExplorer-11-1.18.org.default.xml} (84%) rename StigData/Processed/{InternetExplorer-11-1.16.xml => InternetExplorer-11-1.18.xml} (98%) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2bf50c94b..521b7f801 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ * Fixed [#427](https://github.com/microsoft/PowerStig/issues/427): Windows 10 Rule V-63373 fails to apply settings to system drive * Fixed [#514](https://github.com/microsoft/PowerStig/issues/514): Feature request: additional support for servicerule properties * Fixed [#521](https://github.com/microsoft/PowerStig/issues/521): Organizational setting warning should include Stig name +* Update PowerSTIG to successfully parse MS Internet Explorer 11 STIG - Ver 1, Rel 18: [#538](https://github.com/microsoft/PowerStig/issues/538) * Update PowerSTIG to successfully parse Mozilla Firefox STIG - Ver 4, Rel 27: [#540](https://github.com/microsoft/PowerStig/issues/540) * Update PowerSTIG to successfully parse Microsoft Windows 10 STIG - Ver 1, Rel 19: [533](https://github.com/microsoft/PowerStig/issues/533) * Update PowerSTIG to parse/convert the Windows Server 2012 R2 MS/DC V2R17/V2R18 Respectively: [531](https://github.com/microsoft/PowerStig/issues/531) diff --git a/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R16_Manual-xccdf.log b/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R18_Manual-xccdf.log similarity index 100% rename from StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R16_Manual-xccdf.log rename to StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R18_Manual-xccdf.log diff --git a/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R16_Manual-xccdf.xml b/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R18_Manual-xccdf.xml similarity index 69% rename from StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R16_Manual-xccdf.xml rename to StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R18_Manual-xccdf.xml index 1d514ff3d..9f5db89b9 100644 --- a/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R16_Manual-xccdf.xml +++ b/StigData/Archive/InternetExplorer/U_MS_IE11_STIG_V1R18_Manual-xccdf.xml @@ -1,4 +1,4 @@ -acceptedMicrosoft Internet Explorer 11 Security Technical Implementation GuideThe Microsoft Internet Explorer 11 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.milSettings in this guidance assume a complete installation of Microsoft Internet Explorer 11 on the Windows Platform. Registry paths and values identified in each control assume the use of Group Policy Administrative Templates. Installations not using Group Policies to administer Microsoft Browser products may observe alternate registry paths for stored configuration values.DISASTIG.DOD.MILRelease: 16 Benchmark Date: 27 Jul 20181I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>DTBI014-IE11-TLS setting<GroupDescription></GroupDescription>DTBI014-IE11Turn off Encryption Support must be enabled.<VulnDiscussion>This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser by allowing you to turn on/off support for TLS and SSL. TLS is a protocol for protecting communications between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each other's list of supported protocols and versions and pick the most preferred match..</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IE Version 11DISADPMS TargetIE Version 112589CCI-002450Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Advanced Page >> "Turn off Encryption Support" to "Enabled". +acceptedMicrosoft Internet Explorer 11 Security Technical Implementation GuideThe Microsoft Internet Explorer 11 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.milSettings in this guidance assume a complete installation of Microsoft Internet Explorer 11 on the Windows Platform. Registry paths and values identified in each control assume the use of Group Policy Administrative Templates. Installations not using Group Policies to administer Microsoft Browser products may observe alternate registry paths for stored configuration values.DISASTIG.DOD.MILRelease: 18 Benchmark Date: 25 Oct 20191I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>SRG-APP-000015-WSR-000014<GroupDescription></GroupDescription>IISW-SV-000100The IIS 8.5 web server remote authors or content providers must only use secure encrypted logons and connections to upload web server content.<VulnDiscussion>Logging onto a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used. +acceptedIIS 8.5 Server Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 9 Benchmark Date: 25 Oct 20191I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-APP-000015-WSR-000014<GroupDescription></GroupDescription>IISW-SV-000100The IIS 8.5 web server remote authors or content providers must only use secure encrypted logons and connections to upload web server content.<VulnDiscussion>Logging onto a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used. An alternative to remote administration of the web server is to perform web server administration locally at the console. Local administration at the console implies physical access to the server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-001453Ensure the web server administration is only performed over a secure path.If web administration is performed at the console, this check is NA. @@ -68,11 +68,11 @@ Click the "Logging" icon. Under Log Event Destination, verify the "Both log file and ETW event" radio button is selected. -If the "Both log file and ETW event" radio button is not selected, this is a finding.SRG-APP-000098-WSR-000060<GroupDescription></GroupDescription>IISW-SV-000109An IIS 8.5 web server behind a load balancer or proxy server, must produce log records containing the source client IP and destination information.<VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. +If the "Both log file and ETW event" radio button is not selected, this is a finding.SRG-APP-000098-WSR-000060<GroupDescription></GroupDescription>IISW-SV-000109An IIS 8.5 web server behind a load balancer or proxy server, must produce log records containing the source client IP and destination information.<VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. Ascertaining the correct source, e.g. source IP, of the events is important during forensic analysis. Correctly determining the source of events will add information to the overall reconstruction of the logable event. By determining the source of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the source occurred in other areas within the enterprise. -A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every logable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-000133Access the proxy server through which inbound web traffic is passed and configure settings to pass web traffic to the IIS 8.5 web server transparently.Interview the System Administrator to review the configuration of the IIS 8.5 architecture and determine if inbound web traffic is passed through a proxy. +A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every logable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-000133Access the proxy server through which inbound web traffic is passed and configure settings to pass web traffic to the IIS 8.5 web server transparently.Interview the System Administrator to review the configuration of the IIS 8.5 architecture and determine if inbound web traffic is passed through a proxy. If the IIS 8.5 web server is receiving inbound web traffic through a proxy, the audit logs must be reviewed to determine if correct source information is being passed through by the proxy server. @@ -88,24 +88,21 @@ Click on "View log files" under the "Actions" pane. When the log file is displayed, review source IP information in log entries and verify the entries do not reflect the IP address of the proxy server. -If the log entries in the log file(s) reflect the IP address of the proxy server as the source, this is a finding.SRG-APP-000099-WSR-000061<GroupDescription></GroupDescription>IISW-SV-000110The IIS 8.5 web server must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 8.5 web server events.<VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. +If the website is not behind a load balancer or proxy server, this is Not Applicable. -Ascertaining the success or failure of an event is important during forensic analysis. Correctly determining the outcome will add information to the overall reconstruction of the logable event. By determining the success or failure of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the event occurred in other areas within the enterprise. +If the log entries in the log file(s) reflect the IP address of the proxy server as the source, this is a finding. -Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-000134Access the IIS 8.5 web server IIS Manager. +If provisions have been made to log the client IP via another field (i.e., utilizing X-Forwarded-For), this is not a finding.SRG-APP-000099-WSR-000061<GroupDescription></GroupDescription>IISW-SV-000110The IIS 8.5 web server must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 8.5 web server events.<VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. -Click the IIS 8.5 web server name. +Ascertaining the success or failure of an event is important during forensic analysis. Correctly determining the outcome will add information to the overall reconstruction of the logable event. By determining the success or failure of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the event occurred in other areas within the enterprise. +Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-000134Access the IIS 8.5 web server IIS Manager. +Click the IIS 8.5 web server name. Under "IIS", double-click the "Logging" icon. - Verify the "Format:" under "Log File" is configured to "W3C". - Select the "Fields" button. - Under "Custom Fields", click the "Add Field..." button. - For each field being added, give a name unique to what the field is capturing. - Click on the "Source Type" drop-down list and select "Request Header". Click on the "Source" drop-down list and select "Connection". Click “OK” to add. @@ -113,14 +110,7 @@ Click “OK” to add. Click on the "Source Type" drop-down list and select "Request Header". Click on the "Source" drop-down list and select "Warning". Click “OK” to add. - -Click on the "Source Type" drop-down list and select "Server Variable". -Click “OK” to add. - -Click "OK". - -Click "Apply" under the "Actions" pane. -Access the IIS 8.5 web server IIS Manager. +Click "Apply" under the "Actions" pane.Access the IIS 8.5 web server IIS Manager. Click the IIS 8.5 web server name. @@ -137,63 +127,36 @@ Request Header >> Connection Request Header >> Warning If any of the above fields are not selected, this is a finding. -SRG-APP-000100-WSR-000064<GroupDescription></GroupDescription>IISW-SV-000111The IIS 8.5 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.<VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. +SRG-APP-000100-WSR-000064<GroupDescription></GroupDescription>IISW-SV-000111The IIS 8.5 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.<VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. Determining user accounts, processes running on behalf of the user, and running process identifiers also enable a better understanding of the overall event. User tool identification is also helpful to determine if events are related to overall user access or specific client tools. -Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-001487Access the IIS 8.5 web server IIS Manager. - +Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-001487Access the IIS 8.5 web server IIS Manager. Click the IIS 8.5 web server name. - Under "IIS", double-click the "Logging" icon. - Verify the "Format:" under "Log File" is configured to "W3C". - Select the "Fields" button. - Under "Standard Fields", select "User Agent", "User Name" and "Referrer". - Under "Custom Fields", select the following fields: -Click on the "Source Type" drop-down list and select "Request Header". -Click on the "Source" drop-down list and select "User-Agent". -Click “OK” to add. - Click on the "Source Type" drop-down list and select "Request Header". Click on the "Source" drop-down list and select "Authorization". Click “OK” to add. -Click on the "Source Type" drop-down list and select "Request Header". +Click on the "Source Type" drop-down list and select "Response Header". Click on the "Source" drop-down list and select "Content-Type". Click “OK” to add. - -Click on the "Source Type" drop-down list and select "Server Variable". -Click “OK” to add. - Click "OK". - -Click "Apply" under the "Actions" pane. -Access the IIS 8.5 web server IIS Manager. - +Click "Apply" under the "Actions" pane.Note: If SSL is installed on load balancer through which traffic is routed to the IIS 8.5 server, and the IIS 8.5 server ONLY receives traffic from the load balancer, the SSL requirement must be met on the load balancer. +Access the IIS 8.5 web server IIS Manager. Click the IIS 8.5 web server name. - Under "IIS", double-click the "Logging" icon. - Verify the "Format:" under "Log File" is configured to "W3C". - Select the "Fields" button. - Under "Standard Fields", verify "User Agent", "User Name" and "Referrer" are selected. - Under "Custom Fields", verify the following field have been configured: - -Request Header >> User-Agent - Request Header >> Authorization - Response Header >> Content-Type - -If any of the above fields are not selected, this is a finding. -SRG-APP-000120-WSR-000070<GroupDescription></GroupDescription>IISW-SV-000115The log information from the IIS 8.5 web server must be protected from unauthorized modification or deletion.<VulnDiscussion>A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-000162CCI-000163CCI-000164Open the IIS 8.5 Manager. +If any of the above fields are not selected, this is a finding.SRG-APP-000120-WSR-000070<GroupDescription></GroupDescription>IISW-SV-000115The log information from the IIS 8.5 web server must be protected from unauthorized modification or deletion.<VulnDiscussion>A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-000162CCI-000163CCI-000164Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. @@ -210,35 +173,19 @@ Set the log file permissions for the appropriate group(s). Click "OK". Select "Apply" in the "Actions" pane. -Query the SA to determine who has update access to the web server log files. - -The role of auditor and the role of SA should be distinctly separate. An individual functioning as an auditor should not also serve as an SA due to a conflict of interest. - -Only management authorized individuals with a privileged ID or group ID associated with an auditor role will have access permission to log files that are greater than read on web servers he or she has been authorized to audit. - -Only management authorized individuals with a privileged ID or group ID associated with either an SA or web administrator role may have read authority to log files for the web servers he or she has been authorized to administer. - -If an account with roles other than auditor has greater than read authority to the log files, this is a finding. - -This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files. +This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files. Open the IIS 8.5 Manager. - Click the IIS 8.5 web server name. - Click the "Logging" icon. - Click the "Browse" button and navigate to the directory where the log files are stored. - -Right-click the log file name to review and click Properties. - -Click the "Security" tab. - -If an account associated with roles other than auditors, SAs, or web administrators have any access to log files, this is a finding. - -If an account with roles other than auditor has greater than read authority to the log files, this is a finding. - -This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files. -SRG-APP-000125-WSR-000071<GroupDescription></GroupDescription>IISW-SV-000116The log data and records from the IIS 8.5 web server must be backed up onto a different system or media.<VulnDiscussion>Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up log records to an unrelated system or onto separate media than the system the web server is actually running on helps to assure that, in the event of a catastrophic system failure, the log records will be retained.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-001348Configure system backups to include the directory paths of all IIS 8.5 web server and website log files.The IIS 8.5 web server and website log files should be backed up by the system backup. +Right-click the log file name to review. +Click “Properties”. +Click the “Security” tab. +Verify log file access is restricted as follows. Otherwise, this is a finding. +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control +Web Managers - ReadSRG-APP-000125-WSR-000071<GroupDescription></GroupDescription>IISW-SV-000116The log data and records from the IIS 8.5 web server must be backed up onto a different system or media.<VulnDiscussion>Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up log records to an unrelated system or onto separate media than the system the web server is actually running on helps to assure that, in the event of a catastrophic system failure, the log records will be retained.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-001348Configure system backups to include the directory paths of all IIS 8.5 web server and website log files.The IIS 8.5 web server and website log files should be backed up by the system backup. To determine if log files are backed up by the system backup, determine the location of the web server log files and each website's log files. @@ -394,21 +341,17 @@ Click the IIS 8.5 web server name. Review the features listed under the “IIS" section. -If the "WebDAV Authoring Rules" icon exists, this is a finding.SRG-APP-000175-WSR-000095<GroupDescription></GroupDescription>IISW-SV-000129The IIS 8.5 web server must perform RFC 5280-compliant certification path validation.<VulnDiscussion>This check verifies the server certificate is actually a DoD-issued certificate used by the organization being reviewed. This is used to verify the authenticity of the website to the user. If the certificate is not issued by the DoD or if the certificate has expired, then there is no assurance the use of the certificate is valid. The entire purpose of using a certificate is, therefore, compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-000185Open the IIS 8.5 Manager. +If the "WebDAV Authoring Rules" icon exists, this is a finding.SRG-APP-000175-WSR-000095<GroupDescription></GroupDescription>IISW-SV-000129The IIS 8.5 web server must perform RFC 5280-compliant certification path validation.<VulnDiscussion>This check verifies the server certificate is actually a DoD-issued certificate used by the organization being reviewed. This is used to verify the authenticity of the website to the user. If the certificate is not issued by the DoD or if the certificate has expired, then there is no assurance the use of the certificate is valid. The entire purpose of using a certificate is, therefore, compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-000185Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Double-click the "Server Certificate" icon. -Import a valid DoD certificate and remove any non-DoD certificates.Open the IIS 8.5 Manager. - +Import a valid DoD certificate and remove any non-DoD certificates.Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. - Double-click the "Server Certificate" icon. - Double-click each certificate and verify the certificate path is to a DoD root CA. - -If not, this is a finding.SRG-APP-000206-WSR-000128<GroupDescription></GroupDescription>IISW-SV-000130Java software installed on a production IIS 8.5 web server must be limited to .class files and the Java Virtual Machine.<VulnDiscussion>Mobile code in hosted applications allows the developer to add functionality and displays to hosted applications that are fluid, as opposed to a static web page. The data presentation becomes more appealing to the user, is easier to analyze, and navigation through the hosted application and data is much less complicated. +If the “Issued By” field of the PKI certificate being used by the IIS 8.5 server/site does not indicate the issuing Certificate Authority (CA) is part of the DoD PKI or an approved ECA, this is a finding.SRG-APP-000206-WSR-000128<GroupDescription></GroupDescription>IISW-SV-000130Java software installed on a production IIS 8.5 web server must be limited to .class files and the Java Virtual Machine.<VulnDiscussion>Mobile code in hosted applications allows the developer to add functionality and displays to hosted applications that are fluid, as opposed to a static web page. The data presentation becomes more appealing to the user, is easier to analyze, and navigation through the hosted application and data is much less complicated. Some mobile code technologies in use in today's applications are: Java, JavaScript, ActiveX, PDF, Postscript, Shockwave movies, Flash animations, and VBScript. The DoD has created policies that define the usage of mobile code on DoD systems. The usage restrictions and implementation guidance apply to both the selection and use of mobile code installed on organizational servers and mobile code downloaded and executed on individual workstations. @@ -436,7 +379,7 @@ If the IIS 8.5 web server does not host any applications, this is Not Applicable If the IIS 8.5 web server hosts applications, review the application's management functionality and authentication methods with the System Administrator to determine if the management of the application is accomplished with the same functions and authentication methods as the web server management. -If the IIS 8.5 web server management and the application's management functionality is not separated, this is a finding.SRG-APP-000223-WSR-000011<GroupDescription></GroupDescription>IISW-SV-000134The IIS 8.5 web server must use cookies to track session state.<VulnDiscussion>Cookies are used to exchange data between the web server and the client. Cookies, such as a session cookie, may contain session information and user credentials used to maintain a persistent connection between the user and the hosted application since HTTP/HTTPS is a stateless protocol. +If the IIS 8.5 web server management and the application's management functionality is not separated, this is a finding.SRG-APP-000223-WSR-000011<GroupDescription></GroupDescription>IISW-SV-000134The IIS 8.5 web server must use cookies to track session state.<VulnDiscussion>Cookies are used to exchange data between the web server and the client. Cookies, such as a session cookie, may contain session information and user credentials used to maintain a persistent connection between the user and the hosted application since HTTP/HTTPS is a stateless protocol. Cookies associate session information with client information for the duration of a user’s connection to a website. Using cookies is a more efficient way to track session state than any of the methods that do not use cookies because cookies do not require any redirection. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-001185CCI-001664Open the IIS 8.5 Manager. @@ -448,16 +391,12 @@ Under "ASP.Net", double-click on the "Session State" icon. Under "Cookie Settings", select "Use Cookies” from the "Mode" drop-down list. Click "Apply" in the "Actions" pane. -Open the IIS 8.5 Manager. - +Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. - Under "ASP.Net", double-click on the "Session State" icon. - Under "Cookie Settings", verify the "Mode" has "Use Cookies" selected from the drop-down list. - If the "Cookie Settings" "Mode" is not set to "Use Cookies", this is a finding. -SRG-APP-000223-WSR-000145<GroupDescription></GroupDescription>IISW-SV-000135The IIS 8.5 web server must limit the amount of time a cookie persists.<VulnDiscussion>ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session, and provides the ability to persist variable values for the duration of that session. +Note: If IIS 8.5 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.SRG-APP-000223-WSR-000145<GroupDescription></GroupDescription>IISW-SV-000135The IIS 8.5 web server must limit the amount of time a cookie persists.<VulnDiscussion>ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session, and provides the ability to persist variable values for the duration of that session. Cookies associate session information with client information for the duration of a user’s connection to a website. Using cookies is a more efficient way to track session state than any of the methods that do not use cookies because cookies do not require any redirection. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-001664Open the IIS 8.5 Manager. @@ -469,16 +408,13 @@ Under the "ASP.NET" section, select "Session State". Under "Cookie Settings", select the "Use Cookies" mode from the "Mode:" drop-down list. Under “Time-out (in minutes), enter a value of “20 or less”. -Open the IIS 8.5 Manager. - +Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. - Under the "ASP.NET" section, select "Session State". - Under "Cookie Settings", verify the "Use Cookies" mode is selected from the "Mode:" drop-down list. Under Time-out (in minutes), verify “20 minutes or less” is selected. - If the "Use Cookies” mode is selected and Time-out (in minutes) is configured for “20 minutes or less”, this is not a finding. +Note: If IIS 8.5 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable. SRG-APP-000225-WSR-000074<GroupDescription></GroupDescription>IISW-SV-000136The IIS 8.5 web server must augment re-creation to a stable and known baseline.<VulnDiscussion>Making certain that the web server has not been updated by an unauthorized user is always a concern. Adding patches, functions, and modules that are untested and not part of the baseline opens the possibility for security risks. The web server must offer, and not hinder, a method that allows for the quick and easy reinstallation of a verified and patched baseline to guarantee the production web server is up-to-date and has not been modified to add functionality or expose security risks. When the web server does not offer a method to roll back to a clean baseline, external methods, such as a baseline snapshot or virtualizing the web server, can be used.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-001190Prepare documentation for disaster recovery methods for the IIS 8.5 web server in the event of the necessity for rollback. @@ -538,23 +474,23 @@ If the key does not exist, this check is Not Applicable. Review the Catalog keys to determine if directories other than web document directories are being indexed. -If so, this is a finding.SRG-APP-000266-WSR-000159<GroupDescription></GroupDescription>IISW-SV-000140Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 8.5 web server, patches, loaded modules, and directory paths.<VulnDiscussion>HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-001312Open the IIS 8.5 Manager. +If so, this is a finding.SRG-APP-000266-WSR-000159<GroupDescription></GroupDescription>IISW-SV-000140Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 8.5 web server, patches, loaded modules, and directory paths.<VulnDiscussion>HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-001312Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Double-click the "Error Pages" icon. -Click each error message and click "Edit Feature Setting" from the "Actions" Pane. +Click on any error message and click "Edit Feature Setting" from the "Actions" Pane. This will apply to all error messages. -Set each error message to “Detailed errors for local requests and custom error pages for remote requests”.Open the IIS 8.5 Manager. +Set Feature Setting to “Detailed errors for local requests and custom error pages for remote requests”.Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Double-click the "Error Pages" icon. -Click each error message and click "Edit Feature Setting" from the "Actions" Pane. +Click on any error message and click "Edit Feature Setting" from the "Actions" Pane. This will apply to all error messages. -If any error message is not set to “Detailed errors for local requests and custom error pages for remote requests”, this is a finding.SRG-APP-000315-WSR-000003<GroupDescription></GroupDescription>IISW-SV-000141Remote access to the IIS 8.5 web server must follow access policy or work in conjunction with enterprise tools designed to enforce policy requirements.<VulnDiscussion>Logging into a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-002314Ensure the web server administration is only performed over a secure path.If web administration is performed at the console, this check is Not Applicable. +If the feature setting is not set to “Detailed errors for local requests and custom error pages for remote requests”, this is a finding.SRG-APP-000315-WSR-000003<GroupDescription></GroupDescription>IISW-SV-000141Remote access to the IIS 8.5 web server must follow access policy or work in conjunction with enterprise tools designed to enforce policy requirements.<VulnDiscussion>Logging into a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-002314Ensure the web server administration is only performed over a secure path.If web administration is performed at the console, this check is Not Applicable. If web administration is performed remotely the following checks will apply. @@ -816,9 +752,9 @@ Expand the "session" section. Verify the "keepSessionIdSecure" is set to "True". -If the "keepSessionIdSecure" is not set to "True", this is a finding.SRG-APP-000439-WSR-000156<GroupDescription></GroupDescription>IISW-SV-000153An IIS 8.5 web server must maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.<VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled. +If the "keepSessionIdSecure" is not set to "True", this is a finding.SRG-APP-000439-WSR-000156<GroupDescription></GroupDescription>IISW-SV-000153An IIS 8.5 web server must maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.<VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled. -FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-002418Access the IIS 8.5 Web Server. +FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-002418Access the IIS 8.5 Web Server. Access an administrator command prompt and type "regedit <enter>" to access the server's registry. @@ -836,7 +772,9 @@ HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2 HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server -With a REG_DWORD value of "1" for "DisabledByDefault"Access the IIS 8.5 Web Server. +With a REG_DWORD value of "1" for "DisabledByDefault" + +With a REG_DWORD value of "0" for "Enabled"Access the IIS 8.5 Web Server. Access an administrator command prompt and type "regedit <enter>" to access the server's registry. @@ -855,19 +793,14 @@ HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2 HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server Verify a REG_DWORD value of "1" for "DisabledByDefault" +Verify a REG_DWORD value of "0" for "Enabled" -If any of the respective registry paths are not existent or configured with the wrong value, this is a finding.SRG-APP-000439-WSR-000156<GroupDescription></GroupDescription>IISW-SV-000154A web server must maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.<VulnDiscussion>Transport Layer Security (TLS) is a required transmission protocol for a web server hosting controlled information. The use of TLS provides confidentiality of data in transit between the web server and client. FIPS 140-2-approved TLS versions must be enabled and non-FIPS-approved SSL versions must be disabled. -NIST SP 800-52 defines the approved TLS versions for government applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-002418Configure the web server to use an approved TLS version according to NIST SP 800-52 and to disable all non-approved versions.Review the web server documentation and deployed configuration to determine which version of TLS is being used. - -If the TLS version is not TLS 1.1 or higher, according to NIST SP 800-52, or if non-FIPS-approved algorithms are enabled, this is a finding.SRG-APP-000456-WSR-000187<GroupDescription></GroupDescription>IISW-SV-000155The IIS 8.5 web server must install security-relevant software updates within the configured time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).<VulnDiscussion>Several vulnerabilities are associated with older versions of web server software. As hot fixes and patches are issued, these solutions are included in the next version of the server software. Maintaining the web server at a current version makes the efforts of a malicious user more difficult.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-002605Install the current version of the web server software and maintain appropriate service packs and patches.Determine the most recent patch level of the IIS 8.5 software, as posted on the Microsoft website. +If any of the respective registry paths do not exist or are configured with the wrong value, this is a finding.SRG-APP-000439-WSR-000156<GroupDescription></GroupDescription>IISW-SV-000154A web server must maintain the confidentiality of controlled information during transmission through the use of an approved TLS version.<VulnDiscussion>Transport Layer Security (TLS) is a required transmission protocol for a web server hosting controlled information. The use of TLS provides confidentiality of data in transit between the web server and client. FIPS 140-2-approved TLS versions must be enabled and non-FIPS-approved SSL versions must be disabled. -Open the IIS 8.5 Manager. - -Click "Help", and select "About Internet Information Services". +NIST SP 800-52 defines the approved TLS versions for government applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-002418Configure the web server to use an approved TLS version according to NIST SP 800-52 and to disable all non-approved versions.Review the web server documentation and deployed configuration to determine which version of TLS is being used. -If the version is more than one version behind the most recent patch level, this is a finding. -SRG-APP-000516-WSR-000079<GroupDescription></GroupDescription>IISW-SV-000156All accounts installed with the IIS 8.5 web server software and tools must have passwords assigned and default passwords changed.<VulnDiscussion>During installation of the web server software, accounts are created for the web server to operate properly. The accounts installed can have either no password installed or a default password, which will be known and documented by the vendor and the user community. +If the TLS version is not TLS 1.1 or higher, according to NIST SP 800-52, or if non-FIPS-approved algorithms are enabled, this is a finding.SRG-APP-000516-WSR-000079<GroupDescription></GroupDescription>IISW-SV-000156All accounts installed with the IIS 8.5 web server software and tools must have passwords assigned and default passwords changed.<VulnDiscussion>During installation of the web server software, accounts are created for the web server to operate properly. The accounts installed can have either no password installed or a default password, which will be known and documented by the vendor and the user community. The first things an attacker will try when presented with a logon screen are the default user identifiers with default passwords. Installed applications may also install accounts with no password, making the logon even easier. Once the web server is installed, the passwords for any created accounts should be changed and documented. The new passwords must meet the requirements for all passwords, i.e., upper/lower characters, numbers, special characters, time until change, reuse policy, etc. @@ -930,9 +863,28 @@ Click the IIS 8.5 web server name. Double-click the “Authorization Rules” icon. If any user other than “Administrator” is listed, this is a finding. -SRG-APP-000243<GroupDescription></GroupDescription>IISW-SV-000160Public web server resources must not be shared with private assets.<VulnDiscussion>It is important to segregate public web server resources from private resources located behind the DoD DMZ in order to protect private assets. When folders, drives, or other resources are directly shared between the public web server and private servers the intent of data and resource segregation can be compromised. +SRG-APP-000001-WSR-000001<GroupDescription></GroupDescription>IISW-SV-000200The IIS 8.5 MaxConnections setting must be configured to limit the number of allowed simultaneous session requests.<VulnDiscussion>Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a website, facilitating a Denial of Service attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-000054Access the IIS 8.5 IIS Manager. + +Click the IIS 8.5 server. + +Select "Configuration Editor" under the "Management" section. + +From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites". + +Expand "siteDefaults". +Expand "limits". + +Set the "maxconnections" parameter to a value greater than zero.Access the IIS 8.5 IIS Manager. + +Click the IIS 8.5 server. + +Select "Configuration Editor" under the "Management" section. + +From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites". + +Expand "siteDefaults". +Expand "limits". + +Review the results and verify the value is greater than zero for the "maxconnections" parameter. -Resources, such as, printers, files, and folders/directories must not be shared between public web servers and assets located within the internal network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Installation 8.5DISADPMS TargetIIS Installation 8.52793CCI-001090Configure the public web server to not have a trusted relationship with any system resource that is also not accessible to the public. Web content is not to be shared via Microsoft shares or NFS mounts.1. From a command prompt, type "net share" and press “Enter” to provide a list of available shares (including printers). -2. To display the permissions assigned to the shares type "net share" followed by the share name found in the previous step. -If any private assets are assigned permissions to the share, this is a finding. -If any printers are shared, this is a finding. +If the maxconnections parameter is set to zero, this is a finding. diff --git a/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_STIG_V1R6_Manual-xccdf.xml b/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_STIG_V1R6_Manual-xccdf.xml deleted file mode 100644 index 49c8451ae..000000000 --- a/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_STIG_V1R6_Manual-xccdf.xml +++ /dev/null @@ -1,1413 +0,0 @@ -acceptedIIS 8.5 Site Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 6 Benchmark Date: 25 Jan 20191I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-APP-000001-WSR-000001<GroupDescription></GroupDescription>IISW-SI-000200The IIS 8.5 websites MaxConnections setting must be configured to limit the number of allowed simultaneous session requests.<VulnDiscussion>Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a website, facilitating a Denial of Service attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000054Access the IIS 8.5 IIS Manager. - -Click the IIS 8.5 server. - -Select "Configuration Editor" under the "Management" section. - -From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites". - -Expand "siteDefaults". -Expand "limits". - -Set the "maxconnections" parameter to a value greater than zero.Access the IIS 8.5 IIS Manager. - -Click the IIS 8.5 server. - -Select "Configuration Editor" under the "Management" section. - -From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites". - -Expand "siteDefaults". -Expand "limits". - -Review the results and verify the value is greater than zero for the "maxconnections" parameter. - -If the maxconnections parameter is set to zero, this is a finding.SRG-APP-000001-WSR-000002<GroupDescription></GroupDescription>IISW-SI-000201The IIS 8.5 website session state must be enabled.<VulnDiscussion>When the session information is stored on the client, the session ID, along with the user authorization and identity information, is sent along with each client request and is stored in either a cookie, embedded in the uniform resource locator (URL), or placed in a hidden field on the displayed form. Each of these offers advantages and disadvantages. The biggest disadvantage to all three is the hijacking of a session along with all of the user's credentials. - -When the user authorization and identity information is stored on the server in a protected and encrypted database, the communication between the client and web server will only send the session identifier, and the server can then retrieve user credentials for the session when needed. If, during transmission, the session were to be hijacked, the user's credentials would not be compromised. - -ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session, and provides the ability to persist variable values for the duration of that session.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000054Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name. - -Under the "ASP.NET" section, select "Session State". - -Under "Session State Mode Settings", verify the "In Process" mode is selected. - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name. - -Under the "ASP.NET" section, select "Session State". - -Under "Session State Mode Settings", verify the "In Process" mode is selected. - -If the "Session State Mode Settings" is set to "In Process", this is not a finding. - -Alternative method: - -Click the site name. - -Select "Configuration Editor" under the "Management" section. - -From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". - -Verify the "mode" reflects "InProc". - -If the "mode" is not set to "InProc", this is a finding.SRG-APP-000001-WSR-000002<GroupDescription></GroupDescription>IISW-SI-000202The IIS 8.5 website session state cookie settings must be configured to Use Cookies mode.<VulnDiscussion>When the session information is stored on the client, the session ID, along with the user authorization and identity information, is sent along with each client request and is stored in either a cookie, embedded in the uniform resource locator (URL), or placed in a hidden field on the displayed form. Each of these offers advantages and disadvantages. The biggest disadvantage to all three is the hijacking of a session along with all of the user's credentials. - -When the user authorization and identity information is stored on the server in a protected and encrypted database, the communication between the client and website will only send the session identifier, and the server can then retrieve user credentials for the session when needed. If, during transmission, the session were to be hijacked, the user's credentials would not be compromised. - -ASP.NET provides a session state, which is available as the HttpSessionState class, as a method of storing session-specific information that is visible only within the session. ASP.NET session state identifies requests from the same browser during a limited time window as a session, and provides the ability to persist variable values for the duration of that session. - -Cookies associate session information with client information for the duration of a user’s connection to a website. Using cookies is a more efficient way to track session state than any of the methods that do not use cookies because cookies do not require any redirection. -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000054Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name. - -Under the ASP.NET section, select "Session State". - -Under "Cookie Settings", select the "Use Cookies" from the "Mode:" drop-down list. - -Select "Apply" from the "Actions" pane. -Follow the procedures below for each site hosted on the IIS 8.5 web server: -Open the IIS 8.5 Manager. -Click the site name. -Under the "ASP.NET" section, select "Session State". -Under "Cookie Settings", verify the "Use Cookies" mode is selected from the "Mode:" drop-down list. -If the "Use Cookies" mode is selected, this is not a finding. - -Alternative method: -Click the site name. -Select "Configuration Editor" under the "Management" section. -From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". -Verify the "cookieless" is set to "UseCookies". -If the "cookieless" is not set to "UseCookies", this is a finding. -Note: If IIS 8.5 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable.SRG-APP-000014-WSR-000006<GroupDescription></GroupDescription>IISW-SI-000203A private IIS 8.5 website must only accept Secure Socket Layer connections.<VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled. - -FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000068Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable. - -Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name. - -Double-click the "SSL Settings" icon. - -Select "Require SSL" check box. - -Select "Apply" from the "Actions" pane.Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable. -Note: If SSL is installed on load balancer through which traffic is routed to the IIS 8.5 server, and the IIS 8.5 server ONLY receives traffic from the load balancer, the SSL requirement must be met on the load balancer. -Follow the procedures below for each site hosted on the IIS 8.5 web server: -Open the IIS 8.5 Manager. -Click the site name. -Double-click the "SSL Settings" icon. -Verify "Require SSL" check box is selected. -If the "Require SSL" check box is not selected, this is a finding.SRG-APP-000014-WSR-000006<GroupDescription></GroupDescription>IISW-SI-000204A public IIS 8.5 website must only accept Secure Socket Layer connections when authentication is required.<VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. A private web server must use a FIPS 140-2-approved TLS version, and all non-FIPS-approved SSL versions must be disabled. - -FIPS 140-2-approved TLS versions include TLS V1.1 or greater. NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000068Note: If the server being reviewed is a private IIS 8.5 web server, this is Not Applicable. - -Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name. - -Double-click the "SSL Settings" icon. - -Select "Require SSL" check box. - -Select "Apply" from the "Actions" pane.Note: If the server being reviewed is a private IIS 8.5 web server, this is Not Applicable. - -Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name. - -Double-click the "SSL Settings" icon. - -Verify "Require SSL" check box is selected. - -If the "Require SSL" check box is not selected, this is a finding.SRG-APP-000092-WSR-000055<GroupDescription></GroupDescription>IISW-SI-000205The enhanced logging for each IIS 8.5 website must be enabled and capture, record, and log all content related to a user session.<VulnDiscussion>Log files are a critical component to the successful management of an IS used within the DoD. By generating log files with useful information web administrators can leverage them in the event of a disaster, malicious attack, or other site-specific needs. - -Ascertaining the correct order of the events that occurred is important during forensic analysis. Events that appear harmless by themselves might be flagged as a potential threat when properly viewed in sequence. By also establishing the event date and time, an event can be properly viewed with an enterprise tool to fully see a possible threat in its entirety. - -Without sufficient information establishing when the log event occurred, investigation into the cause of event is severely hindered. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked. - -Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000093-WSR-000053</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-001462CCI-001464Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name. - -Click the "Logging" icon. - -Under Format select "W3C". - -Select the following fields: Date, Time, Client IP Address, User Name, Method, URI Query, Protocol Status, and Referrer. - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name. - -Click the "Logging" icon. - -Under Format select "W3C". - -Click “Select Fields”, verify at a minimum the following fields are checked: Date, Time, Client IP Address, User Name, Method, URI Query, Protocol Status, and Referrer. - -If the "W3C" is not selected as the logging format OR any of the required fields are not selected, this is a finding.SRG-APP-000092-WSR-000055<GroupDescription></GroupDescription>IISW-SI-000206Both the log file and Event Tracing for Windows (ETW) for each IIS 8.5 website must be enabled.<VulnDiscussion>Internet Information Services (IIS) on Windows Server 2012 provides basic logging capabilities. However, because IIS takes some time to flush logs to disk, administrators do not have access to logging information in real-time. In addition, text-based log files can be difficult and time-consuming to process. - -In IIS 8.5, the administrator has the option of sending logging information to Event Tracing for Windows (ETW). This option gives the administrator the ability to use standard query tools, or create custom tools, for viewing real-time logging information in ETW. This provides a significant advantage over parsing text-based log files that are not updated in real time. - -Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000139CCI-001464Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name. - -Click the "Logging" icon. - -Under Log Event Destination, select the "Both log file and ETW event" radio button. - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name. - -Click the "Logging" icon. - -Under Log Event Destination, verify the "Both log file and ETW event" radio button is selected. - -If the "Both log file and ETW event" radio button is not selected, this is a finding.SRG-APP-000098-WSR-000060<GroupDescription></GroupDescription>IISW-SI-000208An IIS 8.5 website behind a load balancer or proxy server, must produce log records containing the source client IP and destination information.<VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. - -Ascertaining the correct source, e.g. source IP, of the events is important during forensic analysis. Correctly determining the source of events will add information to the overall reconstruction of the logable event. By determining the source of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the source occurred in other areas within the enterprise. - -A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every logable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000133Access the proxy server through which inbound web traffic is passed and configure settings to pass web traffic to the IIS 8.5 web server transparently.Interview the System Administrator to review the configuration of the IIS 8.5 architecture and determine if inbound web traffic is passed through a proxy. - -If the IIS 8.5 is receiving inbound web traffic through a proxy, the audit logs must be reviewed to determine if correct source information is being passed through by the proxy server. - -Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name. - -Click the "Logging" icon. - -Click on "View log file" button. - -When log file is displaced, review source IP information in log entries and verify entries do not reflect the IP address of the proxy server. - -If the log entries in the log file(s) reflect the IP address of the proxy server as the source, this is a finding. -If the website is not behind a load balancer or proxy server, this is Not Applicable.SRG-APP-000099-WSR-000061<GroupDescription></GroupDescription>IISW-SI-000209The IIS 8.5 website must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 8.5 website events.<VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. - -Ascertaining the success or failure of an event is important during forensic analysis. Correctly determining the outcome will add information to the overall reconstruction of the logable event. By determining the success or failure of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the event occurred in other areas within the enterprise. - -Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000134Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Select the website being reviewed. - -Under "IIS", double-click the "Logging" icon. - -Configure the "Format:" under "Log File" to "W3C". - -Select the "Fields" button. - -Under "Custom Fields", select the following fields: - -Request Header >> Connection - -Request Header >> Warning - -Click "OK". - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Select the website being reviewed. - -Under "IIS", double-click the "Logging" icon. - -Verify the "Format:" under "Log File" is configured to "W3C". - -Select the "Fields" button. - -Under "Custom Fields", verify the following fields are selected: - -Request Header >> Connection - -Request Header >> Warning - -If any of the above fields are not selected, this is a finding.SRG-APP-000100-WSR-000064<GroupDescription></GroupDescription>IISW-SI-000210The IIS 8.5 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event.<VulnDiscussion>Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. - -Determining user accounts, processes running on behalf of the user, and running process identifiers also enable a better understanding of the overall event. User tool identification is also helpful to determine if events are related to overall user access or specific client tools. - -Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-001487Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Access the IIS 8.5 web server IIS 8.5 Manager. - -Select the website being reviewed. - -Under "IIS", double-click the "Logging" icon. - -Configure the "Format:" under "Log File" to "W3C". - -Select the "Fields" button. - -Under "Standard Fields", select "User Agent", "User Name" and "Referrer". - -Under "Custom Fields", select the following fields: - -Server Variable >> HTTP_USER_AGENT - -Request Header >> Authorization - -Response Header >> Content-Type - -Click "OK". - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Access the IIS 8.5 web server IIS 8.5 Manager. - -Under "IIS", double-click the "Logging" icon. - -Verify the "Format:" under "Log File" is configured to "W3C". - -Select the "Fields" button. - -Under "Standard Fields", verify "User Agent", "User Name" and "Referrer" are selected. - -Under "Custom Fields", verify the following fields have been configured: - -Server Variable >> HTTP_USER_AGENT - -Request Header >> Authorization - -Response Header >> Content-Type - -If any of the above fields are not selected, this is a finding.SRG-APP-000120-WSR-000070<GroupDescription></GroupDescription>IISW-SI-000213The log information from the IIS 8.5 website must be protected from unauthorized modification or deletion.<VulnDiscussion>A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000163CCI-000164Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name. - -Click the "Logging" icon. - -Click "Browse" and navigate to the directory where the log files are stored. - -Right-click the log file name to review and click “Properties”. - -Click the “Security” tab. - -Set the log file permissions for the appropriate group.Follow the procedures below for each site hosted on the IIS 8.5 web server: -Open the IIS 8.5 Manager. -Click the site name. -Click the "Logging" icon. -Click "Browse" and navigate to the directory where the log files are stored. -Right-click the log file name to review and click “Properties”. -Click the “Security” tab. -Verify only authorized groups are listed, if others are listed, this is a finding. -Note: The log file should be restricted as follows: -Eventlog - Full Control -SYSTEM - Full Control -Administrators - Full Control -Web Managers - ReadSRG-APP-000141-WSR-000081<GroupDescription></GroupDescription>IISW-SI-000214The IIS 8.5 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.<VulnDiscussion>Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner. - -A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type. - -A shell is a program that serves as the basic interface between the user and the operating system, so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000381Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click on the IIS 8.5 site. - -Under IIS, double-click the “MIME Types” icon. - -From the "Group by:" drop-down list, select "Content Type". - -From the list of extensions under "Application", remove MIME types for OS shell program extensions, to include at a minimum, the following extensions: - -.exe -.dll -.com -.bat -.csh - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click on the IIS 8.5 site. - -Under IIS, double-click the “MIME Types” icon. - -From the "Group by:" drop-down list, select "Content Type". - -From the list of extensions under "Application", verify MIME types for OS shell program extensions have been removed, to include at a minimum, the following extensions: - -.exe -.dll -.com -.bat -.csh - -If any OS shell MIME types are configured, this is a finding.SRG-APP-000141-WSR-000082<GroupDescription></GroupDescription>IISW-SI-000215Mappings to unused and vulnerable scripts on the IIS 8.5 website must be removed.<VulnDiscussion>IIS 8.5 will either allow or deny script execution based on file extension. The ability to control script execution is controlled through two features with IIS 8.5, Request Filtering and "Handler Mappings". - -For "Handler Mappings", the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the "Handler Mappings" in IIS 8. "Handler Mappings" at the site level take precedence over "Handler Mappings" at the server level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000381Open the IIS 8.5 Manager. - -Click the site name under review. - -Double-click "Handler Mappings". - -Remove any script file extensions listed on the black list that are enabled. - -Select "Apply" from the "Actions" pane.For "Handler Mappings", the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the "Handler Mappings" in IIS 8.5. "Handler Mappings" at the site level take precedence over "Handler Mappings" at the server level. - -Open the IIS 8.5 Manager. - -Click the site name under review. - -Double-click "Handler Mappings". - -If any script file extensions from the black list are enabled, this is a finding.SRG-APP-000141-WSR-000083<GroupDescription></GroupDescription>IISW-SI-000216The IIS 8.5 website must have resource mappings set to disable the serving of certain file types.<VulnDiscussion>Resource mapping is the process of tying a particular file type to a process in the web server that can serve that type of file to a requesting client and to identify which file types are not to be delivered to a client. - -By not specifying which files can and which files cannot be served to a user, the web server could deliver to a user web server configuration files, log files, password files, etc. - -The web server must only allow hosted application file types to be served to a user and all other types must be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000381Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -Double-click "Request Filtering". - -For any file name extensions from the black list which have "Allowed" set to "True", remove the file name extension. - -Select "Deny File Name Extension" from the "Actions" pane. - -Add each file name extension from the black list. - -Select "Apply" from the "Actions" pane.For "Handler Mappings", the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the "Handler Mappings" in IIS 8.5. "Handler Mappings" at the site level take precedence over "Handler Mappings" at the server level. - -Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Double-click "Request Filtering". - -If any file name extensions from the black list have "Allowed" set to "True", this is a finding.SRG-APP-000141-WSR-000085<GroupDescription></GroupDescription>IISW-SI-000217The IIS 8.5 website must have Web Distributed Authoring and Versioning (WebDAV) disabled.<VulnDiscussion>A web server can be installed with functionality that, just by its nature, is not secure. Web Distributed Authoring (WebDAV) is an extension to the HTTP protocol that, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors. - -WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000381Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Access Server Manager on the IIS 8.5 website. - -Select the Local Server. - -Click on "Manage". - -Select "Add Roles and Features". - -Click "Next" on the "Before you begin" dialog box. - -Select "Role-based or feature-based installation" on the "Installation Type" dialog box and click on "Next". - -Select the IIS 8.5 web server on the "Server Selection" dialog box. - -From the "Windows Features" dialog box, navigate to "World Wide Web Services" >> "Common HTTP Features". - -De-select "WebDAV Publishing" and click "Next" to complete removing the WebDAV Publishing feature from the IIS 8.5 web server. - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Select the IIS 8.5 website. - -Review the features listed under the "IIS" section. - -If the "WebDAV Authoring Rules" icon exists, this is a finding.SRG-APP-000141-WSR-000086<GroupDescription></GroupDescription>IISW-SI-000218The production website must configure the Global .NET Trust Level.<VulnDiscussion>A web server may host too many applications. Each application will need certain system resources and privileged operations to operate correctly. An application's trust level determines the permissions granted by the ASP.NET Code Access Security (CAS) policy. An application with full trust permissions may access all resource types on a server and perform privileged operations, while applications running with partial trust have varying levels of operating permissions and access to resources. The CAS determines the permissions granted to the application on the server. Setting a level of trust compatible with the applications will limit the potential harm a compromised application could cause to a system. The web server must be configured to contain and control the applications and protect the system resources and privileged operations from those not needed by the application for operation. - -Limiting the application will confine the potential harm a compromised application could cause to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000381Note: If the server being reviewed is a non-production website, this is Not Applicable. - -Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -Double-click the ".NET Trust Level" icon. - -Set the ".NET Trust Level" to Full or less and click “Apply”. - -Select "Apply" from the "Actions" pane. -Note: If the server being reviewed is a non-production website, this is Not Applicable. - -Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -Double-click the ".NET Trust Level" icon. - -If the ".NET Trust Level" is not set to Full or less, this is a finding. -SRG-APP-000142-WSR-000089<GroupDescription></GroupDescription>IISW-SI-000219Each IIS 8.5 website must be assigned a default host header.<VulnDiscussion>The web server must be configured to listen on a specified IP address and port. Without specifying an IP address and port for the web server to utilize, the web server will listen on all IP addresses available to the hosting server. If the web server has multiple IP addresses, i.e., a management IP address, the web server will also accept connections on the management IP address. - -Accessing the hosted application through an IP address normally used for non-application functions opens the possibility of user access to resources, utilities, files, ports, and protocols that are protected on the desired application IP address.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000382Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Right-click on the site name under review. - -Select “Edit Bindings”. - -Assign hostname entries and unique IP addresses to port 80 for HTTP and port 443 for HTTPS. - -Click "OK". - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Right-click on the site name under review. - -Select “Edit Bindings”. - -Verify there are hostname entries and unique IP addresses assigned to port 80 for HTTP and port 443 for HTTPS. - -If both hostname entries and unique IP addresses are not configure to port 80 for HTTP and port 443 for HTTPS, this is a finding.SRG-APP-000172-WSR-000104<GroupDescription></GroupDescription>IISW-SI-000220A private websites authentication mechanism must use client certificates to transmit session identifier to assure integrity.<VulnDiscussion>A DoD private website must utilize PKI as an authentication mechanism for web users. Information systems residing behind web servers requiring authorization based on individual identity must use the identity provided by certificate-based authentication to support access control decisions. Not using client certificates allows an attacker unauthenticated access to private websites. - -Satisfies: SRG-APP-000172-WSR-000104, SRG-APP-000224-WSR-000135, SRG-APP-000427-WSR-000186</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000197CCI-001188CCI-002470Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable - -Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Double-click the "SSL Settings" icon. - -Verify the "Clients Certificate Required" check box is selected. - -Select "Apply" from the "Actions" pane.Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable. - -Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Double-click the "SSL Settings" icon. - -Verify the "Clients Certificate Required" check box is selected. - -If the "Clients Certificate Required" check box is not selected, this is a finding.SRG-APP-000211-WSR-000031<GroupDescription></GroupDescription>IISW-SI-000221Anonymous IIS 8.5 website access accounts must be restricted.<VulnDiscussion>Many of the security problems that occur are not the result of a user gaining access to files or data for which the user does not have permissions, but rather users are assigned incorrect permissions to unauthorized data. The files, directories, and data that are stored on the web server need to be evaluated and a determination made concerning authorized access to information and programs on the server. Only authorized users and administrative accounts will be allowed on the host server in order to maintain the web server, applications, and review the server operations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-001082Remove the Anonymous access account from all privileged accounts and all privileged groups.Check the account used for anonymous access to the website. - -Follow the procedures below for each site hosted on the IIS 8.5 web server: -Open the IIS 8.5 Manager. - -Double-click "Authentication" in the IIS section of the website’s Home Pane. - -If Anonymous access is disabled, this is Not a Finding. - -If Anonymous access is enabled, click “Anonymous Authentication”. - -Click “Edit” in the "Actions" pane. - -If the “Specific user” radio button is enabled and an ID is specified in the adjacent control box, this is the ID being used for anonymous access. Note: account name. - -Check privileged groups that may allow the anonymous account inappropriate membership: -Open “Server Manager” on the machine. - -Expand Configuration. - -Expand Local Users and Groups. - -Click “Groups”. - -Review members of any of the following privileged groups: - -Administrators -Backup Operators -Certificate Services (of any designation) -Distributed COM Users -Event Log Readers -Network Configuration Operators -Performance Log Users -Performance Monitor Users -Power Users -Print Operators -Remote Desktop Users -Replicator -Users - -Double-click each group and review its members. - -If the IUSR account or any account noted above used for anonymous access is a member of any group with privileged access, this is a finding.SRG-APP-000224-WSR-000136<GroupDescription></GroupDescription>IISW-SI-000223The IIS 8.5 website must generate unique session identifiers that cannot be reliably reproduced.<VulnDiscussion>Communication between a client and the web server is done using the HTTP protocol, but HTTP is a stateless protocol. In order to maintain a connection or session, a web server will generate a session identifier (ID) for each client session when the session is initiated. The session ID allows the web server to track a user session and, in many cases, the user, if the user previously logged into a hosted application. - -By being able to guess session IDs, an attacker can easily perform a man-in-the-middle attack. To truly generate random session identifiers that cannot be reproduced, the web server session ID generator, when used twice with the same input criteria, must generate an unrelated random ID. - -The session ID generator also needs to be a FIPS 140-2-approved generator.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-001188Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name. - -Under the ASP.NET section, select "Session State". - -Under "Session State" Mode Settings, select the "In Process" mode.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name. - -Under the "ASP.NET" section, select "Session State". - -Under "Session State" Mode Settings, verify the "In Process" mode is selected. - -If the "In Process" mode is selected, this is not a finding. - -Alternative method: - -Click the site name. - -Select "Configuration Editor" under the "Management" section. - -From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". - -Verify the "mode" reflects "InProc". - -If the "mode" is not set to "InProc", this is a finding.SRG-APP-000233-WSR-000146<GroupDescription></GroupDescription>IISW-SI-000224The IIS 8.5 website document directory must be in a separate partition from the IIS 8.5 websites system files.<VulnDiscussion>The web document (home) directory is accessed by multiple anonymous users when the web server is in production. By locating the web document (home) directory on the same partition as the web server system file the risk for unauthorized access to these protected files is increased. Additionally, having the web document (home) directory path on the same drive as the system folders also increases the potential for a drive space exhaustion attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-001084Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -Click the “Advanced Settings” from the "Actions" pane. - -Change the Physical Path to the new partition and directory location.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -Click the "Advanced Settings" from the "Actions" pane. - -Review the Physical Path. - -If the Path is on the same partition as the OS, this is a finding.SRG-APP-000246-WSR-000149<GroupDescription></GroupDescription>IISW-SI-000225The IIS 8.5 website must be configured to limit the maxURL.<VulnDiscussion>Request filtering replaces URLScan in IIS, enabling administrators to create a more granular rule set with which to allow or reject inbound web content. By setting limits on web requests, it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The MaxURL Request Filter limits the number of bytes the server will accept in a URL.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-001094Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Click the site name under review. - -Double-click the "Request Filtering" icon. - -Click “Edit Feature Settings” in the "Actions" pane. - -Set the "maxURL" value to "4096" or less.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click on the site name. - -Double-click the "Request Filtering" icon. - -Click “Edit Feature Settings” in the "Actions" pane. - -If the "maxUrl" value is not set to "4096" or less, this is a finding.SRG-APP-000246-WSR-000149<GroupDescription></GroupDescription>IISW-SI-000226The IIS 8.5 website must be configured to limit the size of web requests.<VulnDiscussion>By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. The maxAllowedContentLength Request Filter limits the number of bytes the server will accept in a request.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-001094Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -Double-click the "Request Filtering" icon. - -Click “Edit Feature Settings” in the "Actions" pane. - -Set the "maxAllowedContentLength" value to "30000000" or less.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click on the site name. - -Double-click the "Request Filtering" icon. - -Click “Edit Feature Settings” in the "Actions" pane. - -If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length documented and approved by the ISSO, this is a finding. -SRG-APP-000246-WSR-000149<GroupDescription></GroupDescription>IISW-SI-000227The IIS 8.5 websites Maximum Query String limit must be configured.<VulnDiscussion>By setting limits on web requests, it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The Maximum Query String Request Filter describes the upper limit on allowable query string lengths. Upon exceeding the configured value, IIS will generate a Status Code 404.15.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-001094Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -Double-click the "Request Filtering" icon. - -Click “Edit Feature Settings” in the "Actions" pane. - -Set the "Maximum Query String" value to "2048" or less.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click on the site name. - -Double-click the "Request Filtering" icon. - -Click “Edit Feature Settings” in the "Actions" pane. - -If the "Maximum Query String" value is not set to "2048" or less, this is a finding.SRG-APP-000246-WSR-000149<GroupDescription></GroupDescription>IISW-SI-000228Non-ASCII characters in URLs must be prohibited by any IIS 8.5 website.<VulnDiscussion>By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. The allow high-bit characters Request Filter enables rejection of requests containing non-ASCII characters.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-001094Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -Double-click the "Request Filtering" icon. - -Click “Edit Feature Settings” in the "Actions" pane. - -Uncheck the "Allow high-bit characters" check box.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click on the site name. - -Double-click the "Request Filtering" icon. - -Click “Edit Feature Settings” in the "Actions" pane. - -If the "Allow high-bit characters" check box is checked, this is a finding.SRG-APP-000246-WSR-000149<GroupDescription></GroupDescription>IISW-SI-000229Double encoded URL requests must be prohibited by any IIS 8.5 website.<VulnDiscussion>Request filtering enables administrators to create a more granular rule set with which to allow or reject inbound web content. By setting limits on web requests, it ensures availability of web services and mitigates the risk of buffer overflow type attacks. When the “Allow double escaping” option is disabled it prevents attacks that rely on double-encoded requests.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-001094Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -Double-click the "Request Filtering" icon. - -Click “Edit Feature Settings” in the "Actions" pane. - -Uncheck the "Allow double escaping" check box.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click on the site name. - -Double-click the "Request Filtering" icon. - -Click “Edit Feature Settings” in the "Actions" pane. - -If the "Allow double escaping" check box is checked, this is a finding.SRG-APP-000246-WSR-000149<GroupDescription></GroupDescription>IISW-SI-000230Unlisted file extensions in URL requests must be filtered by any IIS 8.5 website.<VulnDiscussion>Request filtering enables administrators to create a more granular rule set to allow or reject inbound web content. By setting limits on web requests it helps to ensure availability of web services and may also help mitigate the risk of buffer overflow type attacks. The allow unlisted property of the “File Extensions Request” filter enables rejection of requests containing specific file extensions not defined in the “File Extensions” filter. Tripping this filter will cause IIS to generate a Status Code 404.7.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-001094Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -Double-click the "Request Filtering" icon. - -Click “Edit Feature Settings” in the "Actions" pane. - -Uncheck the "Allow unlisted file extensions" check box.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click on the site name. - -Double-click the "Request Filtering" icon. - -Click “Edit Feature Settings” in the "Actions" pane. - -If "Allow unlisted file name extensions" check box is checked, this is a finding.SRG-APP-000251-WSR-000157<GroupDescription></GroupDescription>IISW-SI-000231Directory Browsing on the IIS 8.5 website must be disabled.<VulnDiscussion>Directory browsing allows the contents of a directory to be displayed upon request from a web client. If directory browsing is enabled for a directory in IIS, users could receive a web page listing the contents of the directory. If directory browsing is enabled the risk of inadvertently disclosing sensitive content is increased.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-001310Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the Site. - -Double-click the "Directory Browsing" icon. - -Under the "Actions" pane click "Disabled".Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Click the Site. - -Double-click the "Directory Browsing" icon. - -If the "Directory Browsing" is not installed, this is Not Applicable. - -Under the "Actions" pane verify "Directory Browsing" is "Disabled". - -If "Directory Browsing" is not "Disabled", this is a finding.SRG-APP-000266-WSR-000142<GroupDescription></GroupDescription>IISW-SI-000232The IIS 8.5 website must prevent a web content directory from being displayed.<VulnDiscussion>The goal is to control the web users experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an index.html file is a significant factor to accomplish this end. Also, enumeration techniques, such as URL parameter manipulation, rely upon being able to obtain information about the web server’s directory structure by locating directories with default pages. This practice helps ensure the anonymous web user will not obtain directory browsing information or an error message revealing the server type and version.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-001312Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -Double-click "Default Document". - -In the “Actions” pane select "Enable". - -Click the "Content View" tab, click on each listed "Default Document" and click on "Explore" under the "Actions" pane. Create a valid document for the listed "Default Document".Note: This requirement is only for each site's root directory. - -Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Click the site name under review. - -Double-click "Default Document". - -In the "Actions" pane, verify the "Default Document" feature is enabled. - -If an "Enable" option is listed under the "Actions" pane, the "Default Document" feature is not enabled and this is a finding. - -If "Default Document" is "Enabled, review the document types. - -Click the "Content View" tab, click on each listed "Default Document" and click on "Explore" under the "Actions" pane. Verify there is a document of that type in the directory. - -If "Default Document" is "Enabled" but no listed document types are present in the "Content View", this is a finding.SRG-APP-000266-WSR-000159<GroupDescription></GroupDescription>IISW-SI-000233Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 8.5 website, patches, loaded modules, and directory paths.<VulnDiscussion>HTTP error pages contain information that could enable an attacker to gain access to an information system. Failure to prevent the sending of HTTP error pages with full information to remote requesters exposes internal configuration information to potential attackers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-001312Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -Double-click the "Error Pages" icon. - -Click each error message and click "Edit Feature" Setting from the "Actions" pane; set each error message to “Detailed errors for local requests and custom error pages for remote requests”.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -Double-click the "Error Pages" icon. - -Click each error message and click "Edit Feature" setting from the "Actions" pane. - -If any error message is not set to “Detailed errors for local requests and custom error pages for remote requests”, this is a finding.SRG-APP-000266-WSR-000160<GroupDescription></GroupDescription>IISW-SI-000234Debugging and trace information used to diagnose the IIS 8.5 website must be disabled.<VulnDiscussion>Setting compilation debug to false ensures detailed error information does not inadvertently display during live application usage, mitigating the risk of application information being displayed to users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-001312Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -Double-click ".NET Compilation". - -Scroll down to the "Behavior" section and set the value for "Debug" to "False".Note: If the ".NET feature" is not installed, this check is Not Applicable. - -Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -Double-click ".NET Compilation". - -Scroll down to the "Behavior" section and verify the value for "Debug" is set to "False". - -If the "Debug" value is not set to "False", this is a finding.SRG-APP-000295-WSR-000012<GroupDescription></GroupDescription>IISW-SI-000235The Idle Time-out monitor for each IIS 8.5 website must be enabled.<VulnDiscussion>The idle time-out attribute controls the amount of time a worker process will remain idle before it shuts down. A worker process is idle if it is not processing requests and no new requests are received. - -The purpose of this attribute is to conserve system resources; the default value for idle time-out is 20 minutes. - -By default, the World Wide Web (WWW) service establishes an overlapped recycle, in which the worker process to be shut down is kept running until after a new worker process is started.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-002361Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the Application Pools. - -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. - -Scroll down to the "Process Model" section and set the value for "Idle Time-out" to "20" or less.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the Application Pools. - -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. - -Scroll down to the "Process Model" section and verify the value for "Idle Time-out" is set to "20". - -If the "Idle Time-out" is not set to "20" or less, this is a finding.SRG-APP-000295-WSR-000134<GroupDescription></GroupDescription>IISW-SI-000236The IIS 8.5 websites connectionTimeout setting must be explicitly configured to disconnect an idle session.<VulnDiscussion>Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after a set period of inactivity, the web server can make certain that those sessions that are not closed through the user logging out of an application are eventually closed. - -Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-002361Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name. - -Select "Configuration Editor" under the "Management" section. - -From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". - -Set the "timeout" to "00:20:00 or less”, using the lowest value possible depending upon the application. -Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications. - -In the "Actions" pane, click "Apply". -Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name. - -Select "Configuration Editor" under the "Management" section. - -From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". - -Verify the "timeout" is set to "00:20:00 or less”, using the lowest value possible depending upon the application. -Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications. - -If "timeout" is not set to "00:20:00 or less”, this is a finding. - -SRG-APP-000316-WSR-000170<GroupDescription></GroupDescription>IISW-SI-000237The IIS 8.5 website must provide the capability to immediately disconnect or disable remote access to the hosted applications.<VulnDiscussion>During an attack on the web server or any of the hosted applications, the system administrator may need to disconnect or disable access by users to stop the attack. - -The web server must provide a capability to disconnect users to a hosted application without compromising other hosted applications unless deemed necessary to stop the attack. Methods to disconnect or disable connections are to stop the application service for a specified hosted application, stop the web server, or block all connections through web server access list. - -The web server capabilities used to disconnect or disable users from connecting to hosted applications and the web server must be documented to make certain that, during an attack, the proper action is taken to conserve connectivity to any other hosted application if possible and to make certain log data is conserved for later forensic analysis.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-002322Prepare documented procedures for shutting down an IIS 8.5 website in the event of an attack. The procedure should, at a minimum, provide the following steps: - -Determine the respective website for the application at risk of an attack. - -Access the IIS 8.5 web server IIS 8.5 Manager. - -Select the respective website. - -In the "Actions" pane, under "Manage Website", click on "Stop". - -If necessary, stop all websites. - -If necessary, stop the IIS 8.5 web server by selecting the web server in the IIS 8.5 Manager. - -In the "Actions" pane, under "Manage Server", click on "Stop".Interview the System Administrator and Web Manager. - -Ask for documentation for the IIS 8.5 web server administration. - -Verify there are documented procedures for shutting down an IIS 8.5 website in the event of an attack. The procedure should, at a minimum, provide the following steps: - -Determine the respective website for the application at risk of an attack. - -Access the IIS 8.5 web server IIS 8.5 Manager. - -Select the respective website. - -In the "Actions" pane, under "Manage Website", click on "Stop". - -If necessary, stop all websites. - -If necessary, stop the IIS 8.5 web server by selecting the web server in the IIS 8.5 Manager. - -In the "Actions" pane, under "Manage Server", click on "Stop". - -If there are not documented procedures with, at a minimum, the mentioned steps for stopping a website, this is a finding.SRG-APP-000357-WSR-000150<GroupDescription></GroupDescription>IISW-SI-000238The IIS 8.5 website must use a logging mechanism that is configured to allocate log record storage capacity large enough to accommodate the logging requirements of the IIS 8.5 website.<VulnDiscussion>In order to make certain that the logging mechanism used by the web server has sufficient storage capacity in which to write the logs, the logging mechanism needs to be able to allocate log record storage capacity. - -The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-001849Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Under "IIS" double-click on the "Logging" icon. - -If necessary, in the "Logging" configuration box, redesignate a log path to a location able to house the logs. - -Under "Log File Rollover", deselect the "Do not create new log files" setting. - -Configure a schedule to rollover log files on a regular basis.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Access the IIS 8.5 web server IIS 8.5 Manager. - -Under "IIS" double-click on the "Logging" icon. - -In the "Logging" configuration box, determine the "Directory:" to which the "W3C" logging is being written. - -Confirm with the System Administrator that the designated log path is of sufficient size to maintain the logging. - -Under "Log File Rollover", verify the "Do not create new log files" is not selected. - -Verify a schedule is configured to rollover log files on a regular basis. - -Consult with the System Administrator to determine if there is a documented process for moving the log files off of the IIS 8.5 web server to another logging device. - -If the designated logging path device is not of sufficient space to maintain all log files and there is not a schedule to rollover files on a regular basis, this is a finding.SRG-APP-000383-WSR-000175<GroupDescription></GroupDescription>IISW-SI-000239The IIS 8.5 websites must utilize ports, protocols, and services according to PPSM guidelines.<VulnDiscussion>Web servers provide numerous processes, features, and functionalities that utilize TCP/IP ports. Some of these processes may be deemed unnecessary or too unsecure to run on a production system. - -The web server must provide the capability to disable or deactivate network-related services that are deemed to be non-essential to the server mission, are too unsecure, or are prohibited by the PPSM CAL and vulnerability assessments. - -Failure to comply with DoD ports, protocols, and services (PPS) requirements can result in compromise of enclave boundary protections and/or functionality of the AIS. - -The ISSM will ensure web servers are configured to use only authorized PPS in accordance with the Network Infrastructure STIG, DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM), and the associated Ports, Protocols, and Services (PPS) Assurance Category Assignments List.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-001762Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -In the “Action” Pane, click “Bindings". - -Edit to change an existing binding and set the correct ports and protocol.Review the website to determine if HTTP and HTTPs (e.g., 80 and 443) are used in accordance with those ports and services registered and approved for use by the DoD PPSM. Any variation in PPS will be documented, registered, and approved by the PPSM. - -Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -In the “Action” Pane, click “Bindings”. - -Review the ports and protocols. If unknown ports or protocols are used, then this is a finding.SRG-APP-000427-WSR-000186<GroupDescription></GroupDescription>IISW-SI-000241The IIS 8.5 private website have a server certificate issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).<VulnDiscussion>The use of a DoD PKI certificate ensures clients the private website they are connecting to is legitimate, and is an essential part of the DoD defense-in-depth strategy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-002470Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the Server name. - -Double-click “Server Certificates”. - -Click “Import” under the "Actions" pane. - -Browse to the DoD certificate location, select it, and click “OK”. - -Remove any non-DoD certificates if present. - -Click on the site needing the certificate. - -Select “Bindings” under the "Actions" pane. - -Click on the binding needing a certificate and select “Edit”, or add a site binding for HTTPS. - -Assign the certificate to the website by choosing it under the “SSL Certificate” drop-down and clicking “OK”.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Click the site name under review. - -Click “Bindings” in the “Action” Pane. - -Click the “HTTPS type” from the box. - -Click “Edit”. - -Click “View” and then review and verify the certificate path. - -If the list of CAs in the trust hierarchy does not lead to the DoD PKI Root CA, DoD-approved external certificate authority (ECA), or DoD-approved external partner, this is a finding. - -If HTTPS is not an available type under site bindings, this is a finding.SRG-APP-000429-WSR-000113<GroupDescription></GroupDescription>IISW-SI-000242The IIS 8.5 private website must employ cryptographic mechanisms (TLS) and require client certificates.<VulnDiscussion>When data is written to digital media, such as hard drives, mobile computers, external/removable hard drives, personal digital assistants, flash/thumb drives, etc., there is risk of data loss and data compromise. User identities and passwords stored on the hard drive of the hosting hardware must be encrypted to protect the data from easily being discovered and used by an unauthorized user to access the hosted applications. The cryptographic libraries and functionality used to store and retrieve the user identifiers and passwords must be part of the web server. - -Preventing the disclosure of transmitted information requires that the web server take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS). - -Transmission of data can take place between the web server and a large number of devices/applications external to the web server. Examples are a web client used by a user, a backend database, an audit server, or other web servers in a web cluster. - -If data is transmitted unencrypted, the data then becomes vulnerable to disclosure. The disclosure may reveal user identifier/password combinations, website code revealing business logic, or other user personal information. - -Also satisfies: SRG-APP-000439-WSR-000151</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-002476Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Open the IIS 8.5 Manager. - -Double-click the "SSL Settings" icon under the "IIS" section. - -Select the "Require SSL" setting. - -Select the "Client Certificates Required" setting. - -Click "Apply" in the "Actions" pane. - -Click the site under review. - -Select "Configuration Editor" under the "Management" section. - -From the "Section:" drop-down list at the top of the configuration editor, locate “system.webServer/security/access”. - -Click on the drop-down list for "sslFlags". - -Select the "Ssl128" check box. - -Click "Apply" in the "Actions" pane.Note: If SSL is installed on load balancer through which traffic is routed to the IIS 8.5 server, and the IIS 8.5 server ONLY receives traffic from the load balancer, the SSL requirement must be met on the load balancer. -Follow the procedures below for each site hosted on the IIS 8.5 web server: -Open the IIS 8.5 Manager. -Double-click the "SSL Settings" icon under the "IIS" section. -Verify "Require SSL" is checked. -Verify "Client Certificates Required" is selected. -Click the site under review. -Select "Configuration Editor" under the "Management" section. -From the "Section:" drop-down list at the top of the configuration editor, locate “system.webServer/security/access”. -The value for "sslFlags" set must include "ssl128". -If the "Require SSL" is not selected, this is a finding. -If the "Client Certificates Required" is not selected, this is a finding. -If the "sslFlags" is not set to "ssl128", this is a finding.SRG-APP-000439-WSR-000152<GroupDescription></GroupDescription>IISW-SI-000244IIS 8.5 website session IDs must be sent to the client using TLS.<VulnDiscussion>The HTTP protocol is a stateless protocol. To maintain a session, a session identifier is used. The session identifier is a piece of data that is used to identify a session and a user. If the session identifier is compromised by an attacker, the session can be hijacked. By encrypting the session identifier, the identifier becomes more difficult for an attacker to hijack, decrypt, and use before the session has expired.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-002418Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Access the IIS 8.5 Manager. - -Select the website being reviewed. - -Under "Management" section, double-click the "Configuration Editor" icon. - -From the "Section:" drop-down list, select “system.webServer/asp". - -Expand the "session" section. - -Select "True" for the "keepSessionIdSecure" setting. - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Access the IIS 8.5 Manager. - -Select the website being reviewed. - -Under "Management" section, double-click the "Configuration Editor" icon. - -From the "Section:" drop-down list, select “system.webServer/asp". - -Expand the "session" section. - -Verify the "keepSessionIdSecure" is set to "True". - -If the "keepSessionIdSecure" is not set to "True", this is a finding.SRG-APP-000439-WSR-000154<GroupDescription></GroupDescription>IISW-SI-000246Cookies exchanged between the IIS 8.5 website and the client must use SSL/TLS, have cookie properties set to prohibit client-side scripts from reading the cookie data and must not be compressed.<VulnDiscussion>A cookie is used when a web server needs to share data with the client's browser. The data is often used to remember the client when the client returns to the hosted application at a later date. A session cookie is a special type of cookie used to remember the client during the session. The cookie will contain the session identifier (ID) and may contain authentication data to the hosted application. To protect this data from easily being compromised, the cookie must be encrypted. - -When a cookie is sent encrypted via SSL/TLS, an attacker must spend a great deal of time and resources to decrypt the cookie. If, along with encryption, the cookie is compressed, the attacker can now use a combination of plaintext injection and inadvertent information leakage through data compression to reduce the time needed to decrypt the cookie. This attack is called Compression Ratio Info-leak Made Easy (CRIME). - -Cookies shared between the web server and the client when encrypted should not also be compressed. - -A cookie can be read by client-side scripts easily if cookie properties are not set properly. By allowing cookies to be read by the client-side scripts, information such as session identifiers could be compromised and used by an attacker who intercepts the cookie. Setting cookie properties (i.e. HttpOnly property) to disallow client-side scripts from reading cookies better protects the information inside the cookie. - - - -Satisfies: SRG-APP-000439-WSR-000154, SRG-APP-000439-SSR-000155, SRG-APP-000439-WSR-000153</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-002418Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Access the IIS 8.5 Manager. - -Under "Management" section, double-click the "Configuration Editor" icon. - -From the "Section:" drop-down list, select "system.web/httpCookies". - -Set the "require SSL" to "True". - -From the "Section:" drop-down list, select "system.web/sessionState". - -Set the "compressionEnabled" to "False". - -Select "Apply" from the "Actions" pane.Follow the procedures below for each site hosted on the IIS 8.5 web server: - -Access the IIS 8.5 Manager. - -Under "Management" section, double-click the "Configuration Editor" icon. - -From the "Section:" drop-down list, select "system.web/httpCookies". - -Verify the "require SSL" is set to "True". - -From the "Section:" drop-down list, select "system.web/sessionState". - -Verify the "compressionEnabled" is set to "False". - -If both the "system.web/httpCookies:require SSL" is set to "True" and the "system.web/sessionState:compressionEnabled" is set to "False", this is not a finding.SRG-APP-000441-WSR-000181<GroupDescription></GroupDescription>IISW-SI-000249The IIS 8.5 website must maintain the confidentiality and integrity of information during preparation for transmission and during reception.<VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. - -An example of this would be an SMTP queue. This queue may be added to a web server through an SMTP module to enhance error reporting or to allow developers to add SMTP functionality to their applications. - -Any modules used by the web server that queue data before transmission must maintain the confidentiality and integrity of the information before the data is transmitted. - -Information can be either unintentionally or maliciously disclosed or modified during reception, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. - -Protecting the confidentiality and integrity of received information requires that application servers take measures to employ approved cryptography in order to protect the information during transmission over the network. This is usually achieved through the use of Transport Layer Security (TLS), SSL VPN, or IPsec tunnel. - -The web server must utilize approved encryption when receiving transmitted data. - -Also satisfies: SRG-APP-000442-WSR-000182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-002420CCI-002422Follow the procedures below for web server and each site under review: - -Open the IIS 8.5 Manager. - -Click the site name. - -Double-click the "SSL Settings" icon. - -Select "Require SSL" check box.Check: -Note: If SSL is installed on load balancer through which traffic is routed to the IIS 8.5 server, and the IIS 8.5 server ONLY receives traffic from the load balancer, the SSL requirement must be met on the load balancer. -Follow the procedures below for each site hosted on the IIS 8.5 web server: -Open the IIS 8.5 Manager. -Double-click the "SSL Settings" icon under the "IIS" section. -Verify "Require SSL" is checked. -Verify "Client Certificates Required" is selected. -Click the site under review. -Select "Configuration Editor" under the "Management" section. -From the "Section:" drop-down list at the top of the configuration editor, locate “system.webServer/security/access”. -The value for "sslFlags" should be “ssl128”. -If the "Require SSL" is not selected, this is a finding. -If the "Client Certificates Required" is not selected, this is a finding. -If the "sslFlags" is not set to "ssl128", this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IISW-SI-000251The IIS 8.5 website must have a unique application pool.<VulnDiscussion>Application pools isolate sites and applications to address reliability, availability, and security issues. Sites and applications may be grouped according to configurations, although each site will be associated with a unique application pool.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000366Open the IIS 8.5 Manager. - -Click the site name under review. - -Assign a unique application pool to each website.Open the IIS 8.5 Manager. - -Click "Application Pools". - -In the list of Application Pools, review the "Applications" column and verify unique application pools for each website. - -If any Application Pools are being used for more than one website, this is a finding. -SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IISW-SI-000252The maximum number of requests an application pool can process for each IIS 8.5 website must be explicitly set.<VulnDiscussion>IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000366Open the IIS 8.5 Manager. - -Click on the “Application Pools”. - -Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane. - -Scroll down to the "Recycling section" and set the value for "Request Limit" to greater than "0". - -Click “OK”. -Note: Recycling Application Pools can create an unstable environment in a 64-bit SharePoint environment. If operational issues arise, with supporting documentation from the ISSO, this check can be downgraded to a Cat III. - -Open the IIS 8.5 Manager. - -Perform for each Application Pool. - -Click the “Application Pools”. - -Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane. - -Scroll down to the "Recycling section" and verify the value for "Request Limit" is set to a value other than "0". - -If the "Request Limit" is set to a value of "0", this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IISW-SI-000253The amount of virtual memory an application pool uses for each IIS 8.5 website must be explicitly set.<VulnDiscussion>IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000366Open the IIS 8.5 Manager. - -Click on “Application Pools”. - -Perform for each Application Pool. - -Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane. - -In the "Advanced Settings" dialog box scroll down to the "Recycling" section and set the value for "Virtual Memory Limit" to a value other than "0". - -Click “OK”.Note: Recycling Application Pools can create an unstable environment in a 64-bit SharePoint environment. If operational issues arise, mitigation steps can be set, to include setting the “Fixed number or requests”, “Specific time”, and “Private memory usage” in the recycling conditions lieu of the “Virtual memory” setting. If mitigation is used in lieu of this requirement, with supporting documentation from the ISSO, this check can be downgraded to a Cat III. - -Open the IIS 8.5 Manager. - -Perform for each Application Pool. - -Click on “Application Pools”. - -Highlight an Application Pool and click "Advanced Settings" in the Action Pane. - -In the "Advanced Settings" dialog box scroll down to the "Recycling" section and verify the value for "Virtual Memory Limit" is not set to 0. - -If the value for "Virtual Memory Limit" is set to 0, this is a finding. -SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IISW-SI-000254The amount of private memory an application pool uses for each IIS 8.5 website must be explicitly set.<VulnDiscussion>IIS application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks. By default, application pool recycling is overlapped, which means the worker process to be shut down is kept running until after a new worker process is started. After a new worker process starts, new requests are passed to it. The old worker process shuts down after it finishes processing its existing requests, or after a configured time-out, whichever comes first. This way of recycling ensures uninterrupted service to clients.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000366Open the IIS 8.5 Manager. - -Click the “Application Pools”. - -Perform for each Application Pool. - -Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane. - -Scroll down to the "Recycling" section and set the value for "Private Memory Limit" to a value other than "0".Note: Recycling Application Pools can create an unstable environment in a 64-bit SharePoint environment. If operational issues arise, with supporting documentation from the ISSO this check can be downgraded to a Cat III. - -Open the IIS 8.5 Manager. - -Perform for each Application Pool. - -Click the “Application Pools”. - -Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane. - -Scroll down to the "Recycling" section and verify the value for "Private Memory Limit" is set to a value other than "0". - -If the "Private Memory Limit" is set to a value of "0", this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IISW-SI-000255The application pool for each IIS 8.5 website must have a recycle time explicitly set.<VulnDiscussion>Application pools can be periodically recycled to avoid unstable states possibly leading to application crashes, hangs, or memory leaks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000366Open the IIS 8.5 Manager. - -Click the “Application Pools”. - -Perform for each Application Pool. - -Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane. - -Scroll down to the "Recycling" section and expand the "Generate Recycle Event Log Entry" section. - -Set both the "Regular time interval" and "Specific time" options to "True".Note: Recycling Application Pools can create an unstable environment in a 64-bit SharePoint environment. If operational issues arise, with supporting documentation from the ISSO this check can be downgraded to a Cat III. - -Open the IIS 8.5 Manager. - -Perform for each Application Pool. - -Click the “Application Pools”. - -Highlight an Application Pool and click "Advanced Settings" in the “Action” Pane. - -Scroll down to the "Recycling" section and expand the "Generate Recycle Event Log Entry" section. - -Verify both the "Regular time interval" and "Specific time" options are set to "True". - -If both the "Regular time interval" and "Specific time" options are not set to "True", this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IISW-SI-000256The maximum queue length for HTTP.sys for each IIS 8.5 website must be explicitly configured.<VulnDiscussion>In order to determine the possible causes of client connection errors and to conserve system resources, it is important to both log errors and manage those settings controlling requests to the application pool.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000366Open the IIS 8.5 Manager. - -Click the “Application Pools”. - -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. - -Scroll down to the “General” section and set the value for “Queue Length” to “1000” or less. - -Click “OK”.Open the IIS 8.5 Manager. - -Perform for each Application Pool. - -Click the “Application Pools”. - -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. - -Scroll down to the "General" section and verify the value for "Queue Length" is set to 1000. - -If the "Queue Length" is set to "1000" or less, this is not a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IISW-SI-000257The application pools pinging monitor for each IIS 8.5 website must be enabled.<VulnDiscussion>Windows Process Activation Service (WAS) manages application pool configurations and may flag a worker process as unhealthy and shut it down. An application pool’s pinging monitor must be enabled to confirm worker processes are functional. A lack of response from the worker process might mean the worker process does not have a thread to respond to the ping request, or it is hanging for some other reason. The ping interval and ping response time may need adjustment to gain access to timely information about application pool health without triggering false, unhealthy conditions; for example, instability caused by an application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000366Open the IIS 8.5 Manager. - -Click the “Application Pools”. - -Perform for each Application Pool. - -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. - -Scroll down to the "Process Model" section and set the value for "Ping Enabled" to "True". - -Click “OK”.Open the Internet Information Services (IIS) Manager. - -Click the “Application Pools”. - -Perform for each Application Pool. - -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. - -Scroll down to the "Process Model" section and verify the value for "Ping Enabled" is set to "True". - -If the value for "Ping Enabled" is not set to "True", this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IISW-SI-000258The application pools rapid fail protection for each IIS 8.5 website must be enabled.<VulnDiscussion>Rapid fail protection is a feature that interrogates the health of worker processes associated with websites and web applications. It can be configured to perform a number of actions such as shutting down and restarting worker processes that have reached failure thresholds. By not setting rapid fail protection the web server could become unstable in the event of a worker process crash potentially leaving the web server unusable.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000366Open the IIS 8.5 Manager. - -Click the “Application Pools”. - -Perform for each Application Pool. - -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. - -Scroll down to the "Rapid Fail Protection" section and set the value for "Enabled" to "True". - -Click “OK”.Open the IIS 8.5 Manager. - -Click the “Application Pools”. - -Perform for each Application Pool. - -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. - -Scroll down to the "Rapid Fail Protection" section and verify the value for "Enabled" is set to "True". - -If the "Rapid Fail Protection:Enabled" is not set to "True", this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IISW-SI-000259The application pools rapid fail protection settings for each IIS 8.5 website must be managed.<VulnDiscussion>Windows Process Activation Service (WAS) manages application pool configuration and may flag a worker process as unhealthy and shut it down. The rapid fail protection must be set to a suitable value. A lack of response from the worker process might mean the worker process does not have a thread to respond to the ping request, or that it is hanging for some other reason. The ping interval and ping response time may need adjustment to gain access to timely information about application pool health without triggering false, unhealthy conditions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000366Open the IIS 8.5 Manager. - -Click the “Application Pools”. - -Perform for each Application Pool. - -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. - -Scroll down to the "Rapid Fail Protection" section and set the value for "Failure Interval" to "5" or less. - -Click “OK”.Open the IIS 8.5 Manager. - -Click the “Application Pools”. - -Perform for each Application Pool. - -Highlight an Application Pool to review and click "Advanced Settings" in the "Actions" pane. - -Scroll down to the "Rapid Fail Protection" section and verify the value for "Failure Interval" is set to "5". - -If the "Failure Interval" is not set to "5" or less, this is a finding.SRG-APP-000141-WSR-000087<GroupDescription></GroupDescription>IISW-SI-000261Interactive scripts on the IIS 8.5 web server must be located in unique and designated folders.<VulnDiscussion>CGI and ASP scripts represent one of the most common and exploitable means of compromising a web server. All CGI and ASP program files must be segregated into their own unique folder to simplify the protection of these files. ASP scripts must be placed into a unique folder only containing other ASP scripts. JAVA and other technology-specific scripts must also be placed into their own unique folders. The placement of CGI, ASP, or equivalent scripts to special folders gives the Web Manager or the SA control over what goes into those folders and to facilitate access control at the folder level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000381All interactive programs must be placed in unique designated folders based on CGI or ASP script type. - -Open the IIS 8.5 Manager. - -Right-click the IIS 8.5 web server name and select Explore. - -Search for the listed script extensions. - -Move each script type to its unique designated folder. - -Set the permissions to the scripts folders as follows: - -Administrators: FULL -TrustedInstaller: FULL -SYSTEM: FULL -ApplicationPoolId:READ -Custom Service Account: READ -Users: READ -ALL APPLICATION PACKAGES: READ -Determine whether scripts are used on the web server for the target website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx. - -All interactive programs must be placed in unique designated folders based on CGI or ASP script type. - -Open the IIS 8.5 Manager. - -Right-click the IIS 8.5 web site name and select Explore. - -Search for the listed script extensions. Each script type must be in its unique designated folder. - -If scripts are not segregated from web content and in their own unique folders, then this is a finding.SRG-APP-000141-WSR-000087<GroupDescription></GroupDescription>IISW-SI-000262Interactive scripts on the IIS 8.5 web server must have restrictive access controls.<VulnDiscussion>CGI is a programming standard for interfacing external applications with information servers, such as HTTP or web servers. CGI, represented by all upper case letters, should not be confused with the .cgi file extension. The .cgi file extension does represent a CGI script, but CGI scripts may be written in a number of programming languages (e.g., PERL, C, PHP, and JavaScript), each having their own unique file extension. - -The use of CGI scripts represent one of the most common and exploitable means of compromising a web server. By definition, CGI scripts are executable by the operating system of the host server. While access control is provided via the web service, the execution of CGI programs is not limited unless the SA or the Web Manager takes specific measures. CGI programs can access and alter data files, launch other programs, and use the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000381Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx. - -If the website does not utilize CGI, this finding is NA. - -All interactive programs must have restrictive permissions. - -Open the IIS 8.5 Manager. - -Right-click the IIS 8.5 web server name and select “Explore”. - -Search for the listed script extensions. - -Set the permissions to the CGI scripts as follows: - -Administrators: FULL -TrustedInstaller: FULL -ALL APPLICATION PACKAGES: Read -SYSTEM: FULL -ApplicationPoolId: READ -Custom Service Account: READ -Users: READDetermine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx. - -If the website does not utilize CGI, this finding is Not Applicable. - -All interactive programs must have restrictive permissions. - -Open the IIS 8.5 Manager. - -Right-click the IIS 8.5 web site name and select “Explore”. - -Search for the listed script extensions. - -Review the permissions to the CGI scripts and verify only the permissions listed, or more restrictive permissions are assigned. - -Administrators: FULL -TrustedInstaller: FULL -ALL APPLICATION PACKAGES: Read -SYSTEM: FULL -ApplicationPoolId: READ -Custom Service Account: READ -Users: READ - -If the permissions are less restrictive than listed above, this is a finding.SRG-APP-000141-WSR-000087<GroupDescription></GroupDescription>IISW-SI-000263Backup interactive scripts on the IIS 8.5 server must be removed.<VulnDiscussion>Copies of backup files will not execute on the server, but they can be read by the anonymous user if special precautions are not taken. Such backup copies contain the same sensitive information as the actual script being executed and, as such, are useful to malicious users. Techniques and systems exist today to search web servers for such files and are able to exploit the information contained in them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000381Remove the backup files from the production web server.Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx. - -If the website does not utilize CGI, this finding is Not Applicable. - -Open the IIS 8.5 Manager. - -Right-click the IIS 8.5 web site name and select “Explore”. - -Search for the listed script extensions - -Search for the following files: *.bak, *.old, *.temp, *.tmp, *.backup, or “copy of...”. - -If files with these extensions are found, this is a finding.SRG-APP-000516-WSR-000174<GroupDescription></GroupDescription>IISW-SI-000264The required DoD banner page must be displayed to authenticated users accessing a DoD private website.<VulnDiscussion>A consent banner will be in place to make prospective entrants aware that the website they are about to enter is a DoD web site and their activity is subject to monitoring. The document, DoDI 8500.01, establishes the policy on the use of DoD information systems. It requires the use of a standard Notice and Consent Banner and standard text to be included in user agreements. The requirement for the banner is for websites with security and access controls. These are restricted and not publicly accessible. If the website does not require authentication/authorization for use, then the banner does not need to be present. A manual check of the document root directory for a banner page file (such as banner.html) or navigation to the website via a browser can be used to confirm the information provided from interviewing the web staff.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000366Configure a DoD private website to display the required DoD banner page when authentication is required for user access.Note: This requirement is only applicable for private DoD websites. - -If a banner is required, the following banner page must be in place: - -“You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. - -By using this IS (which includes any device attached to this IS), you consent to the following conditions: - --The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. - -- At any time, the USG may inspect and seize data stored on this IS. - -- Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. - -- This IS includes security measures (e.g., authentication and access controls) to protect USG interests—not for your personal benefit or privacy. - -- Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.” - -OR - -If your system cannot meet the character limits to store this amount of text in the banner, the following is another option for the warning banner: - -"I've read & consent to terms in IS user agreem't." - -NOTE: While DoDI 8500.01 does not contain a copy of the banner to be used, it does point to the RMF Knowledge Service for a copy of the required text. It is also noted that the banner is to be displayed only once when the individual enters the site and not for each page. - -If the access-controlled website does not display this banner page before entry, this is a finding. diff --git a/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_STIG_V1R7_Manual-xccdf.log b/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_STIG_V1R7_Manual-xccdf.log deleted file mode 100644 index 3a21ef363..000000000 --- a/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_STIG_V1R7_Manual-xccdf.log +++ /dev/null @@ -1 +0,0 @@ -V-76819::If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length documented and approved by the ISSO, this is a finding.::If the "maxAllowedContentLength" value is not explicitly set to "30000000" or less or a length approved by the ISSO, this is a finding. diff --git a/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_STIG_V1R6_Manual-xccdf.log b/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R9_Manual-xccdf.log similarity index 100% rename from StigData/Archive/Web Server/U_MS_IIS_8-5_Site_STIG_V1R6_Manual-xccdf.log rename to StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R9_Manual-xccdf.log diff --git a/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_STIG_V1R7_Manual-xccdf.xml b/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R9_Manual-xccdf.xml similarity index 83% rename from StigData/Archive/Web Server/U_MS_IIS_8-5_Site_STIG_V1R7_Manual-xccdf.xml rename to StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R9_Manual-xccdf.xml index 5c60f0b1b..3f4dad625 100644 --- a/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_STIG_V1R7_Manual-xccdf.xml +++ b/StigData/Archive/Web Server/U_MS_IIS_8-5_Site_V1R9_Manual-xccdf.xml @@ -1,28 +1,4 @@ -acceptedIIS 8.5 Site Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 7 Benchmark Date: 26 Apr 20191I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-APP-000001-WSR-000001<GroupDescription></GroupDescription>IISW-SI-000200The IIS 8.5 websites MaxConnections setting must be configured to limit the number of allowed simultaneous session requests.<VulnDiscussion>Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a website, facilitating a Denial of Service attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target IIS Web Site 8.5DISADPMS TargetIIS Web Site 8.52791CCI-000054Access the IIS 8.5 IIS Manager. - -Click the IIS 8.5 server. - -Select "Configuration Editor" under the "Management" section. - -From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites". - -Expand "siteDefaults". -Expand "limits". - -Set the "maxconnections" parameter to a value greater than zero.Access the IIS 8.5 IIS Manager. - -Click the IIS 8.5 server. - -Select "Configuration Editor" under the "Management" section. - -From the "Section:" drop-down list at the top of the configuration editor, locate "system.applicationHost/sites". - -Expand "siteDefaults". -Expand "limits". - -Review the results and verify the value is greater than zero for the "maxconnections" parameter. - -If the maxconnections parameter is set to zero, this is a finding.SRG-APP-000001-WSR-000002<GroupDescription></GroupDescription>IISW-SI-000201The IIS 8.5 website session state must be enabled.<VulnDiscussion>When the session information is stored on the client, the session ID, along with the user authorization and identity information, is sent along with each client request and is stored in either a cookie, embedded in the uniform resource locator (URL), or placed in a hidden field on the displayed form. Each of these offers advantages and disadvantages. The biggest disadvantage to all three is the hijacking of a session along with all of the user's credentials. +acceptedIIS 8.5 Site Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 9 Benchmark Date: 25 Oct 20191I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-APP-000268-DB-000164<GroupDescription></GroupDescription>SQL2-00-023000The system must activate an alarm and/or automatically shut SQL Server down if a failure is detected in its software components. <VulnDiscussion>Predictable failure prevention requires organizational planning to address system failure issues. If components key to maintaining system security fail to function, then SQL Server could continue operating in an unsecure state. The organization must be prepared, and the system must be configured, to send an alarm for such conditions and/or automatically shut SQL Server down. - -If appropriate actions are not taken when component failures occur, a denial of service condition may occur. Appropriate actions can include conducting a graceful application shutdown to avoid losing information. - -For the purposes of this requirement, "component" may be interpreted as meaning any of the Windows services that comprise a SQL Server instance. "The system" encompasses SQL Server itself, the Windows operating system, and any monitoring/management tools used to control the server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001328Configure the system to activate an alarm and/or trigger a SQL Server shutdown when a component failure is detected.Check the configuration of SQL Server, the operating system and any monitoring/management tools to verify the system activates an alarm and/or triggers a shutdown of SQL Server when a component failure is detected. - -If system does not take either or both actions, this is a finding.SRG-APP-000265-DB-000161<GroupDescription></GroupDescription>SQL2-00-022700SQL Server must identify potential security-relevant error conditions.<VulnDiscussion>The structure and content of SQL Server error messages need to be carefully considered by the organization and development team. The extent to which the application is able to identify and handle error conditions is guided by organizational policy and operational requirements. - -Database logs can be monitored for specific security-related errors. Any error that can have a negative effect on database security should be quickly identified and forwarded to the appropriate personnel. If security-relevant error conditions are not identified by SQL Server they may be overlooked by the personnel responsible for addressing them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001311Monitor SQL Server log files to determine when a security-related error occurs. - -Add/Update list of appropriate personnel that are to be alerted when a security related error condition occurs to system documentation. Consider an automated job for both the monitor and the alerting.Security-related errors must be identified and monitored. In most cases, these items would appear in the SQL Server log file. - -If security-related error conditions are not being monitored to meet this requirement, this is a finding.SRG-APP-000264-DB-000136<GroupDescription></GroupDescription>SQL2-00-022600SQL Server must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission.<VulnDiscussion>Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS), VPN, or IPSEC tunnel. - -Information in transmission is particularly vulnerable to attack. If the DBMS does not employ cryptographic mechanisms preventing unauthorized disclosure of information during transit, the information may be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001131Deploy organization-approved encryption to the SQL Server network connections. - -Where physical network devices are used for encryption, set them up such that: - -1. The plaintext connection to the database server is afforded the highest protections, allowing no access to unauthorized or non-cleared personnel. -2. The encryption device is configured to pass traffic to only the specific IP addresses as identified by the database documentation. -3. The encryption keys utilized are current and valid keys. -4. The keys utilized meet approved organizationally defined compliant algorithms. - -Where SQL Server network encryption is used, open SQL Server Configuration Manager. Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right click on Protocols for [NAME OF INSTANCE], where [NAME OF INSTANCE] is a placeholder for the SQL Server instance name, and click on Properties. On the Flags tab, set Force Encryption to YES, provide a DoD certificate on the Certificate tab. If the DBMS exists in the unclassified environment, and data transmission does not cross the boundary between the NIPRNet and the wider Internet, and the application owner and authorizing official have determined that encryption is not required, this is not a finding. - -Check SQL Server and network settings to determine whether cryptographic mechanisms are used to prevent the unauthorized disclosure of information during transmission. If not, this is a finding. - -Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, the severity of this check should be downgraded to Category II. - -From Command Prompt, open SQL Server Configuration Manager by typing sqlservermanager11.msc, and pressing [ENTER]. - -Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right click on Protocols for [NAME OF INSTANCE], where [NAME OF INSTANCE] is a placeholder for the SQL Server instance name, and click on Properties. - -On the Flags tab, if Force Encryption is set to "YES", examine the certificate used on the Certificate tab. - -If Force Encryption is set, a DoD Certificate is not utilized, and a physical encryption measure is utilized, examine the physical encryption devices to determine the following: - -1. The plaintext connection to the database server is afforded the highest protections, allowing no access to unauthorized or non-cleared personnel. -2. The encryption device is configured to pass traffic to only the specific IP addresses as identified by the database documentation. -3. The encryption keys utilized are current and valid keys. -4. The keys utilized meet approved organizationally defined compliant algorithms. - -If any of the preceding requirements is not met, this is a finding. - -If Force Encryption is set to "NO" or a DoD Certificate is not utilized, and physical encryption measures are not utilized, this is a finding.SRG-APP-000248-DB-000135<GroupDescription></GroupDescription>SQL2-00-022400SQL Server must ensure, if Database Availability Groups are being used and there is a server failure, that none of the potential failover servers would suffer from resource exhaustion.<VulnDiscussion>SQL Server has a feature called 'Availability Group' which provides automatic failover from a primary SQL Server to a secondary server. This concept is not new, but because SQL Server does warn that if the secondary SQL Server is not dedicated 100% to being a backup server, that "resource exhaustion" may be an issue if there is some load balancing going on. - -If the primary SQL Server has a backup/secondary server that is dedicated 100% to the primary server's process, this is not a finding. If, however, the processing of the primary SQL Server is loaded to a secondary server that is already partly resourced to process something other than that of the primary SQL Server responsibility, then there can be load balancing issues. - -Load balancing for the purpose of sharing a secondary/backup SQL Server is often done to share and save on resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001096Allocate replacement server(s) to provide failover support to the Primary SQL Server. - -If a single solution cannot be employed, split the processing of a secondary SQL Server amongst two or more secondary servers.If Database Availability Groups are not being used, this is not applicable (NA). - -Check the system documentation and check with the administrator regarding processing resources of the backup/secondary SQL Server. - -If the primary SQL Server has a backup/secondary server that is dedicated 100% to the primary server's processing, this is not a finding. - -If the secondary/backup SQL Server is already partly resourced to process something other than that of the primary SQL Server processing, then determine what resources would be required for the secondary/backup SQL Server. - -If the secondary/backup SQL Server is determined to not have enough processing resources to fulfill the function of the primary server's SQL Server process, this is a finding.SRG-APP-000248-DB-000135<GroupDescription></GroupDescription>SQL2-00-022300SQL Server must limit the use of resources by priority and not impede the host from servicing processes designated as a higher priority.<VulnDiscussion>Priority protection helps prevent a lower-priority process from delaying or interfering with the information system servicing any higher-priority process. This control does not apply to components in the information system for which there is only a single user/role. The application must limit the use of resources by priority. - -SQL Server often runs queries for multiple users at the same time. If lower priority processes are utilizing a disproportionately high amount of database resources, this can severely impact higher priority processes. - -Even if SQL Server's utilization is very small and there may seem to be no need to priority protection, often resources grow exponentially and must be implemented as part of an initial deployment.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001096SQL Server utilizes the "Resource Governor" to determine who is allowed high processing resources. There are several configurations regarding the "Resource Governor" that mostly comes down to users or groups of users having a "MAX_CPU_PERCENT", "MIN_CPU_PERCENT", "MIN_MEMORY_PERCENT", and/or "MAX_MEMORY_PERCENT" settings. - -Users are assigned to Workgroups and the Workgroups are configured processing resources via the "Resource Governor".Review system documentation and determine if one type or more of SQL Server users has a business need for priority usage over other types of users. The need for prioritization most frequently occurs when SQL Server resources are shared between two or more applications or systems where the number of users on more than one system is small or non-existent. This needs to be the case, because SQL Server limits resource based on user accounts and not what process is running. - -If SQL Server has users that are determined to run significantly high priority processes than other users and the SQL Server "Resource Governor" is not being implemented, this is a finding.SRG-APP-000233-DB-000124<GroupDescription></GroupDescription>SQL2-00-021500SQL Server must isolate security functions from nonsecurity functions by means of separate security domains.<VulnDiscussion>Security functions are defined as "the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based". - -Developers and implementers can increase the assurance in security functions by employing well-defined security policy models; structured, disciplined, and rigorous hardware and software development techniques; and sound system/security engineering principles. - -Database Management Systems typically separate security functionality from nonsecurity functionality via separate databases or schemas. Database objects or code implementing security functionality should not be commingled with objects or code implementing application logic. When security and nonsecurity functionality is commingled, users who have access to nonsecurity functionality may be able to access security functionality.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001084Locate security-related database objects and code in a separate database, schema, or other separate security domain from database objects and code implementing application logic.Determine elements of security functionality (lists of permissions, additional authentication information, stored procedures, application specific auditing, etc.) which are being housed inside SQL server. - -For any elements found, check SQL Server to determine if these objects or code implementing security functionality are located in a separate security domain, such as a separate database or schema created specifically for security functionality. - -Run the following queryto list all the user-defined databases: -SELECT Name -FROM sys.databases -WHERE database_id > 4 -ORDER BY 1; - -If security-related database objects or code are not kept separate, this is a finding.SRG-APP-000203-DB-000146<GroupDescription></GroupDescription>SQL2-00-020400SQL Server must associate and maintain security labels when exchanging information between systems.<VulnDiscussion>When data is exchanged between information systems, the security attributes associated with said data need to be maintained. - -Security attributes are an abstraction representing the basic properties or characteristics of an entity with respect to safeguarding information, typically associated with internal data structures (e.g., records, buffers, files) within the information system and used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy. - -Security attributes may be explicitly or implicitly associated with the information contained within the information system. - -If database security labels are not maintained as information moves between systems, handling instructions can be lost and data can be accidentally distributed to unauthorized individuals.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001157Develop SQL code or acquire a third party tool to perform data labeling. SQL Server Label Security Toolkit can be downloaded from http://www.codeplex.com. This tool can satisfy all data labeling and security data labeling requirements.Review system documentation to determine if the labeling of sensitive data is required under organization-defined guidelines. - -If the labeling of sensitive data is not required, this is NA. - -Obtain system configuration setting to determine how data labeling is being performed. This can be through triggers or some other SQL developed means or via a third-party tool. Check to ensure that labels are being associated to data when information is being exchanged between systems. - -If the labeling is not being associated to data when exchanging data between systems, this is a finding.SRG-APP-000201-DB-000145<GroupDescription></GroupDescription>SQL2-00-020300SQL Server must protect the integrity of publicly available information and SQL Servers configuration from unauthorized Server Roles access.<VulnDiscussion>The purpose of this control is to ensure organizations explicitly address the protection needs for public information and applications, with such protection likely being implemented as part of other security controls. If SQL Server contains publicly available information, though not concerned with confidentiality, SQL Server must maintain the integrity of the data. If data available to the public is not protected from unauthorized modification or deletion, then the data cannot be trusted by those accessing it. - -The user account associated with public access must not have access to the OS or SQL Server configuration information, include read access to schema information. - -This requirement is not intended to prevent the establishment of public-facing systems for the purpose of collecting data from the public.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001149Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Logins >> right click <'user account'> >> Properties >> Server Roles. - -Uncheck the 'Server Roles' that are checked and grant more than read-only access to the publicly available information.If SQL Server is not housing or distributing publicly available information, this finding is NA. - -Obtain from the DBA or system documentation the list of publicly available data within SQL Server and the role names that assign read-only access to that public data. - -Obtain the publicly available user account name being used to access SQL Server. - -Navigate to Start >> Administrative Tools >> Server Manager >> Server Manager (<'server name'>) >> Configuration >> Local Users and Groups >> Groups >> right click 'Guests' >> Properties >> 'Members:' -The publicly available user account will likely be in the OS 'Guests' group. - -Determine if SQL Server is granting more than read access to the publicly available information through SQL Server 'Server Roles'. - -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Logins >> right click <'user account'> >> Properties >> Server Roles. - -If any 'Server Roles' are marked that grant more than read access to the publicly available information, this is a finding.SRG-APP-000201-DB-000145<GroupDescription></GroupDescription>SQL2-00-020200SQL Server must protect the integrity of publicly available information and SQL Servers configuration from unauthorized User Mapping access.<VulnDiscussion>The purpose of this control is to ensure organizations explicitly address the protection needs for public information and applications, with such protection likely being implemented as part of other security controls. If SQL Server contains publicly available information, though not concerned with confidentiality, SQL Server must maintain the integrity of the data. If data available to the public is not protected from unauthorized modification or deletion, then the data cannot be trusted by those accessing it. - -The user account associated with public access must not have access to the OS or SQL Server configuration information, include read access to schema information. This access includes, but is not limited to, SQL Server 'User Mapping' assignments. - -SQL Server access to any of the three system databases (master, model, or msdb) is restricted from the publicly available user account, because this would grant more than read-only access to public information. Of the existing user-defined databases, privileges must be checked to allow only read access to publically available data. - -This requirement is not intended to prevent the establishment of public-facing systems for the purpose of collecting data from the public.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001149Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Logins >> right click <'user account'> >> Properties >> User Mapping >> highlight checked database. - -Uncheck the 'Database role membership' that is checked and grants more than read-only access to the publicly available information.If SQL Server is not housing or distributing publicly available information, this finding is NA. - -Obtain from the DBA or system documentation the list of publicly available data within SQL Server. - -Obtain the publicly available user account name being used to access SQL Server. - -Navigate to Start >> Administrative Tools >> Server Manager >> Server Manager (<'server name'>) >> Configuration >> Local Users and Groups >> Groups >> right click 'Guests' >> Properties >> 'Members:' -The publicly available user account will likely be in the OS 'Guests' group. - -Determine if SQL Server is granting more than read access to the publicly available information through SQL Server 'User Mapping'. - -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Logins >> right click <'user account'> >> Properties >> User Mapping. - -If any of the three system databases are checked (indicating a granted privilege): master, model, or msdb, this is a finding.SRG-APP-000201-DB-000145<GroupDescription></GroupDescription>SQL2-00-020100SQL Server must protect the integrity of publicly available information and applications.<VulnDiscussion>The purpose of this control is to ensure organizations explicitly address the protection needs for public information and applications, with such protection likely being implemented as part of other security controls. If SQL Server contains publicly available information, though not concerned with confidentiality, SQL Server OS must maintain the integrity of the data. If data available to the public is not protected from unauthorized modification or deletion, then the data cannot be trusted by those accessing it. - -The user account associated with public access must not have access to the OS configuration information. Determine what publicly available user account is being used to access SQL Server and validate that the publicly available user account only has read access to the public data and nothing else. - -The OS level 'Guests' role grants connection access to the server without granting any other privileges. SQL Server configuration settings are used to grant access to the publicly available information, but this control ensures that the OS only is granted connection access to the server. - -This requirement is not intended to prevent the establishment of public-facing systems for the purpose of collecting data from the public.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001149Using an account with System Administrator privileges, from a command prompt, type lusrmgr.msc, and press [ENTER]. -Navigate to Groups. - -Locate the additional group(s) from which the publicly available user account must be removed. - -Right click <'the group to modify' >> Properties >> 'Members:' - -Remove the publicly available user account from the group by clicking/highlighting the account and then clicking the 'Remove' button. - -Revoke any update permissions for a guest being used in the context of a guest account.If SQL Server is not housing or distributing publicly available information, this finding is NA. - -If SQL Server supports an application collecting information from the public, this is NA. - -Obtain the publicly available user account name being used to access SQL Server. - -Using an account with System Administrator privileges, from a command prompt, type lusrmgr.msc, and press [ENTER]. -Navigate to Groups >> right click 'Guests' >> Properties >> 'Members:' -The publicly available user account will be in the OS 'Guests' group, or another explicitly defined group. - -Determine if the obtained publicly available user account is located in any other groups. - -In lusrmgr.msc, navigate to Users. Right click publicly available account name. Click Properties, then click the 'Member of' tab. - -If the publicly available user account is found in any group 'Members' listing other than 'Guests', this is a finding. - -In SQL, for the account that is used for public access, ensure that read-only access is the only access granted. If any other access is granted, this is a finding.SRG-APP-000201-DB-000145<GroupDescription></GroupDescription>SQL2-00-020000SQL Server must protect the integrity of publicly available information and SQL Servers configuration from unauthorized Securables access.<VulnDiscussion>The purpose of this control is to ensure organizations explicitly address the protection needs for public information and applications, with such protection likely being implemented as part of other security controls. - -SQL Server must be configured to contain publicly available information. Though not concerned with confidentiality, SQL Server must maintain the integrity of the data. If data available to the public is not protected from unauthorized modification or deletion, then the data cannot be trusted by those accessing it. A publicly available user account must not have access to the OS or SQL Server configuration information, including read access to schema information. Determine what publicly available user account is being used to access SQL Server and validate that the publicly available user account only has read access to the public data and nothing else. This read-only access does not include SQL Server 'Securables' assignments. - -SQL Server 'Securables' assignments grant the assignee privileges that are beyond read access to data. No public user account must have SQL Server 'Securables' privileges. Any assigned 'Securables' privileges to the public user account must be removed. - -Likely the only 'Server roles' assignment for the publicly available user account would be 'public'. The only other 'Server roles' that could be authorized as read-only is a user-defined 'Server role'. It is more likely that read-only access is set up at the user database instance in role(s) specifically set up for this purpose. Assignment to the user database instances are made in the 'User Mapping' highlight within a user's properties. - -This requirement is not intended to prevent the establishment of public-facing systems for the purpose of collecting data from the public.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001149Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Logins >> right click <'user account'> >> Properties >> Securables >> highlight 'Securable Name'. - -Uncheck all 'Grant', 'With Grant', and 'Deny' for the highlighted 'Securable'.If SQL Server is not housing or distributing publicly available information, this finding is NA. - -If SQL Server supports an application collecting information from the public, this is NA. - -Obtain from the DBA or system documentation the list of publicly available data within SQL Server. -Obtain the publicly available user account(s) being used to access SQL Server. - -Determine if SQL Server is granting more than read access to the publicly available information through SQL Server 'Securables'. - -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Logins >> right click <'user account'> >> Properties >> Securables. - -If any 'Securables' are listed, this is a finding.SRG-APP-000196-DB-000141<GroupDescription></GroupDescription>SQL2-00-019600SQL Server databases in the classified environment, containing classified or sensitive information, must be encrypted using approved cryptography.<VulnDiscussion>Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data. - -Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. - -Data files that are not encrypted are vulnerable to theft. When data files are not encrypted, they can be copied and opened on a separate system. The data can be compromised without the information owner's knowledge that the theft has even taken place. - -NSA has developed Type 1 algorithms for protecting classified information. The Committee on National Security Systems (CNSS) National Information Assurance Glossary (CNSS Instruction No. 4009) defines Type 1 products as: -“Cryptographic equipment, assembly or component classified or certified by NSA for encrypting and decrypting classified and sensitive national security information when appropriately keyed. -Developed using established NSA business processes and containing NSA approved algorithms are used to protect systems requiring the most stringent protection mechanisms.” - -NSA-approved cryptography is required to be used for classified information system processing. - -See FIPS Publication 140-2 and related documents for guidance on approved encryption techniques and certified encryption modules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001144Configure SQL Server to encrypt sensitive or classified data stored in each database. Use only NIST-certified or NSA-approved cryptography to provide encryption.If the system exists in the non-classified environment, this is NA. - -For each database under the SQL Server instance, review the system documentation to determine whether the database holds classified or sensitive information. If it does not, this is not a finding. - -If it does handle classified or sensitive information, review the system documentation and configuration to determine whether the classified information is protected by NSA- and NIST-approved cryptography. If not, this is a finding. - -If DBMS data encryption is required, ensure the status of encryption by executing: - -SELECT - d.name AS [Database Name], - CASE e.encryption_state - WHEN 0 THEN 'No database encryption key present, no encryption' - WHEN 1 THEN 'Unencrypted' - WHEN 2 THEN 'Encryption in progress' - WHEN 3 THEN 'Encrypted' - WHEN 4 THEN 'Key change in progress' - WHEN 5 THEN 'Decryption in progress' - WHEN 6 THEN 'Protection change in progress' - END AS [Encryption State] -FROM sys.dm_database_encryption_keys e -RIGHT JOIN sys.databases d ON DB_NAME(e.database_id) = d.name -WHERE d.name NOT IN ('master','model','msdb') -ORDER BY 1 -; -For each user database where encryption is required, verify that encryption is in effect. If not, this is a finding. -SRG-APP-000198-DB-000143<GroupDescription></GroupDescription>SQL2-00-019800SQL Server must employ NSA-approved cryptography to protect classified information.<VulnDiscussion>Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. - -NSA has developed Type 1 algorithms for protecting classified information. The Committee on National Security Systems (CNSS) National Information Assurance Glossary (CNSS Instruction No. 4009) defines Type 1 products as: -“Cryptographic equipment, assembly or component classified or certified by NSA for encrypting and decrypting classified and sensitive national security information when appropriately keyed. -Developed using established NSA business processes and containing NSA approved algorithms are used to protect systems requiring the most stringent protection mechanisms.” - -NSA-approved cryptography is required to be used for classified information system processing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001146Document within the system documentation the type of information hosted on SQL Server: classified, sensitive, and/or unclassified. - -Obtain and utilize native or third-party NIST-validated FIPS 140-2 compliant cryptography solution on SQL Server. - -Configure cryptographic functions to use FIPS 140-2 compliant algorithms functions. - -Use DoD certificates to create asymmetric keys stored in the database and used to encrypt sensitive data stored in the database. - -Run the following SQL script to create a certificate: -USE <database name> -CREATE CERTIFICATE <certificate name> - ENCRYPTION BY PASSWORD = '<password>' - FROM FILE = '<path/file_name>' - WITH SUBJECT = '<name of person creating key>', - EXPIRY_DATE = '<expiration date: yyyymmdd>' - -Run the following SQL script to create a symmetric key and assign an existing certificate: -USE <database name> -CREATE SYMMETRIC KEY <'key name'> - WITH ALGORITHM = AES_256 - ENCRYPTION BY CERTIFICATE <certificate name> - -Assign the application object owner account as the owner of asymmetric and symmetric keys, and certificates. (Ownership is assigned via the AUTHORIZATION clause of the CREATE statement, or the ALTER AUTHORIZATION statement.) - -Create audit events for access to the key by other than the application owner account or approved application objects. (If using a server-level SQL Server Audit specification, DATABASE_OBJECT_PERMISSION_CHANGE_GROUP accomplishes this.) - -Revoke any privileges on encryption keys assigned to principals other than the application object owner account and authorized users. - -Protect the private key by encrypting it with the database or service master key. - -For whole-database encryption (Transparent Data Encryption - TDE): -USE master; -CREATE MASTER KEY ENCRYPTION BY PASSWORD = '<password>'; -CREATE CERTIFICATE <certificate name> . . .; -USE <database name>; -CREATE DATABASE ENCRYPTION KEY -WITH ALGORITHM = AES_256 -ENCRYPTION BY SERVER CERTIFICATE <certificate name>; -ALTER DATABASE <database name> -SET ENCRYPTION ON; -Review system documentation to determine whether cryptography for classified or sensitive information is required by the information owner. - -If the system documentation does not specify the type of information hosted on SQL Server: classified, sensitive and/or unclassified, this is a finding. - -If neither classified nor sensitive information exists within SQL Server databases or configuration, this requirement is NA. -Note: If the SQL Server is compliant, nothing is displayed. - -If cryptography is being used by SQL Server, examine evidence that an audit record is created whenever the asymmetric key is accessed by other than authorized users. In particular, view evidence that access by a SYSADMIN or other system privileged account results in the generation of an audit record. This is required because system privileges allow access to encryption keys and can be used to access sensitive data where there is not a need-to-know. - -Note: The list of acceptable algorithms: "AES 128", "AES 192", "AES 256" and "Triple DES". - -If cryptography is being used by SQL Server, verify that the cryptography is NIST FIPS 140-2 certified by running the following SQL query: -EXEC sp_MSforeachdb -' -DECLARE @nCount integer; - -SELECT @nCount = Count(*) - FROM [?].sys.symmetric_keys - WHERE key_algorithm NOT IN (''D3'',''A1'',''A2'',''A3''); - -IF @nCount > 0 - SELECT ''?'' AS ''database ?'' - , name - , algorithm_desc - FROM [?].sys.symmetric_keys - WHERE key_algorithm NOT IN (''D3'',''A1'',''A2'',''A3'') - ORDER BY name, algorithm_desc; -' -; - -If any items list showing an uncertified NIST FIPS 140-2 algorithm type, this is a finding. -If an audit record is not generated for unauthorized access to the asymmetric key, this is a finding. - -Detailed information on the NIST Cryptographic Module Validation Program (CMVP) is available at the following website: http://csrc.nist.gov/groups/STM/cmvp/index.html.SRG-APP-000180-DB-000115<GroupDescription></GroupDescription>SQL2-00-018900SQL Server must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).<VulnDiscussion>Non-organizational users include all information system users other than organizational users, which include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). - -Non-organizational users shall be uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization when related to the use of anonymous access, such as accessing a web server. - -This may be accomplished by a code embedded within the userid, or via a flag or code columns in a table of users, or by some other means. In any case, the user must be individually identified to, and within, SQL Server via a mapping to an individual account and not mapping to a shared account. - -Accordingly, a risk assessment is used in determining the authentication needs of the organization. - -Scalability, practicality, and security are simultaneously considered in balancing the need to ensure ease of use for access to federal information and information systems with the need to protect and adequately mitigate risk to organizational operations, organizational assets, individuals, and other organizations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000804Configure SQL Server to uniquely identify and authenticate all non-organizational users who log onto the system. This likely would be done via a combination of the operating system with unique accounts and the SQL Server by ensuring mapping to individual accounts.Review documentation, SQL Server settings and authentication system settings to determine if non-organizational users are individually identified and authenticated when logging onto the system. - -If non-organizational users are not uniquely identified and authenticated, this is a finding.SRG-APP-000171-DB-000074<GroupDescription></GroupDescription>SQL2-00-018600SQL Server must enforce password encryption for storage.<VulnDiscussion>SQL Server must enforce password encryption when storing passwords. Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read and easily compromised. - -Passwords stored in clear text are vulnerable to unauthorized disclosure. Database passwords should always be encoded or encrypted when stored internally or externally to SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000196Develop, document, and maintain a list of SQL Server database objects, database configuration files, associated scripts, and applications defined within or external to SQL Server that access the database/user environment files/settings in the System Security Plan. - -Record whether they do or do not contain SQL Server passwords. If passwords are present, ensure they are encrypted.Since Windows security is being leveraged, this check applies to database configuration files, associated scripts, and applications external to SQL Server that access the database. - -Ask the DBA and/or IAO to determine if any SQL Server database objects, database configuration files, associated scripts, or applications defined as external to SQL Server that access the database/user environment files/settings contain database passwords. If any do, confirm that SQL Server passwords stored externally to the SQL Server are encoded or encrypted. If any passwords are stored in clear text, this is a finding.SRG-APP-000153-DB-000108<GroupDescription></GroupDescription>SQL2-00-018500SQL Server must ensure users are authenticated with an individual authenticator prior to using a shared authenticator.<VulnDiscussion>To ensure individual accountability and prevent unauthorized access, application users (and any processes acting on behalf of users) must be individually identified and authenticated. - -A shared authenticator is a generic account used by multiple individuals. Use of a shared authenticator alone does not uniquely identify individual users. An example of a shared authenticator is the UNIX OS 'root' user account, a Windows 'administrator' account, an 'sa' account, or a 'helpdesk' account. - -Legitimate use of shared accounts includes, for example, connection pooling. Since this is insufficient to ensure non-repudiation, such shared accounts should be kept "under the covers," be inaccessible directly to end users, be invoked only after successful individual authentication, be communicated to the DBMS by the application, and be recorded in all relevant audit contexts. - -(Shared accounts should not be confused with Windows groups, which are used in role-based access control.)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000770Remove user-accessible shared accounts and use individual userids. - -Build/configure applications to ensure successful individual authentication prior to shared account access. - -Ensure each user's identity is received and used in audit data in all relevant circumstances.Review SQL Server users to determine whether shared accounts exist. - -If accounts are determined to be shared, determine if individuals are first individually authenticated. If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. - -If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding.SRG-APP-000148-DB-000103<GroupDescription></GroupDescription>SQL2-00-018400SQL Server must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).<VulnDiscussion>To ensure accountability and prevent unauthorized SQL Server access, organizational users shall be identified and authenticated. - -Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). - -Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on SQL Server without identification or authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000764Remove user-accessible shared accounts and use individual userids. - -Build/configure applications to ensure successful individual authentication prior to shared account access. - -Ensure each user's identity is received and used in audit data in all relevant circumstances.Review SQL Server users to determine whether shared accounts exist. (This does not include when SQL Server has a guest or public account that is providing access to publicly available information.) - -If accounts are determined to be shared, determine if individuals are first individually authenticated. If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. - -If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding.SRG-APP-000146-DB-000100<GroupDescription></GroupDescription>SQL2-00-018300SQL Server software libraries must be periodically backed up.<VulnDiscussion>SQL Server backups are a critical step in maintaining data assurance and availability. - -System-level information includes system-state information, operating system and application software, and licenses. - -Backups shall be consistent with organization-defined recovery time and recovery point objectives. - -SQL Server depends upon the availability and integrity of its software libraries. Without backups, compromise or loss of the software libraries can prevent a successful recovery of SQL Server operations. - -A mixture of full and incremental server-level backups by a third-party tool that backs up those software library directories would satisfy this requirement.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000537Ensure inclusion of all SQL Server software libraries into the backup process.Review evidence of inclusion of SQL Server software libraries in current backup records. -If the backup tool does not include SQL Server, this is a finding.SRG-APP-000146-DB-000099<GroupDescription></GroupDescription>SQL2-00-018200SQL Server backups of system-level information per organization-defined frequency must be performed that is consistent with recovery time and recovery point objectives.<VulnDiscussion>SQL Server backups are a critical step in maintaining data assurance and availability. - -System-level information includes: system-state information, operating system and application software, and licenses. - -Backups shall be consistent with organizationally defined recovery time and recovery point objectives. - -SQL Server depends upon the availability and integrity of its system-level information. Without backups, compromise or loss of system-level information can prevent a successful recovery of SQL Server operations. If SQL Server system-level information is not backed up regularly this risks the loss of SQL Server data in the event of a system failure. - -A mixture of full and incrementally server level backups that backup the system-level information would satisfy this requirement.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000537Deploy a backup solution to perform backups as per organizationally defined Backup Policy.Windows Server Backup, or a 3rd Party Backup Tool, can be utilized to perform this function. Determine how SQL Server is being backed up. If there is no scheduled backup or if organizationally defined backup policy and procedures does not exist, this is finding. - -Check evidence of inclusion of system-level information into current backup records, if the organizationally defined backup policy, procedures, and backup configurations is not including system-level information backups, this is a finding.SRG-APP-000145-DB-000098<GroupDescription></GroupDescription>SQL2-00-018100SQL Server backup and restoration files must be protected from unauthorized access.<VulnDiscussion>SQL Server backups are a critical step in maintaining data assurance and availability. - -User-level information is data generated by information system and/or application users. In order to assure availability of this data in the event of a system failure, DoD organizations are required to ensure user generated data is backed up at a defined frequency. This includes data stored on file systems, within databases or within any other storage media. - -Applications performing backups must be capable of backing up user-level information per the DoD-defined frequency. - -Lost or compromised SQL Server backup or restoration files may lead to not only the loss of data, but also the unauthorized access to sensitive data. - -SQL Server can maintain local copies of critical control files to provide transparent or easy recovery from hard disk loss or other interruptions to database operation. - -Backup files, both local to the SQL Server machine and not local to the machine, need the same protections against unauthorized access when stored on backup media as when online and actively in use by the database system. In addition, the backup media needs to be protected against physical loss.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000535Develop, document, and implement protection against unauthorized access of backup and restoration files. - -Document personnel and the level of access authorized for each to the backup and restoration files in the system documentation.Obtain authorized access list for backup and restoration procedures from system documentation. - -If documented procedures are insufficient to show or describe authorized personnel, this is a finding. - -Review file protections assigned to online backup and restoration files. - -Review access protections and procedures for offline backup and restoration files. - -If backup or restoration files are subject to unauthorized access, this is a finding. - -It may be necessary to review backup and restoration procedures to determine ownership and access during all phases of backup and recovery. In addition to physical and host system protections, consider other methods including encryption protection of the files.SRG-APP-000145-DB-000097<GroupDescription></GroupDescription>SQL2-00-017900SQL Server recovery procedures that are documented must be implemented and periodically tested.<VulnDiscussion>SQL Server backups are a critical step in maintaining data assurance and availability. - -User-level information is data generated by the information system and/or application users. In order to assure availability of this data in the event of a system failure, DoD organizations are required to ensure user-generated data is backed up at a defined frequency. This includes data stored on file systems, within SQL Server or within any other storage media. - -Applications performing backups must be capable of backing up user-level information per the DoD-defined frequency. - -Problems with backup procedures or backup media may not be discovered until after a recovery is needed. Testing and verification of procedures provides the opportunity to discover oversights, conflicts, or other issues in the backup procedures or use of media designed to be used. - -Part of an overall backup and recovery methodology includes regular recovery testing. This is very important and helps to expose any issue in the recovery process (e.g., hardware, procedures, etc.).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000535Develop or update recovery procedures and add the new recovery procedures to the system documentation. - -Plan for and test system recovery procedures and document the test.Review SQL Server's documented testing and recovery procedures that exist in the system documentation. - -If the testing or recovery procedures are not documented in the system documentation, this is a finding. - -If the documented testing or recovery procedures are not sufficient to test or recover SQL Server configuration and databases, this is a finding. - -Review evidence of implementation of testing and verification procedures by reviewing logs from backup and recovery implementation. Logs may be in electronic form or hardcopy, and may include email or other notification. - -If the system recovery testing has not been implemented and documented, this is a finding.SRG-APP-000145-DB-000096<GroupDescription></GroupDescription>SQL2-00-017800SQL Server backup procedures must be defined, documented, and implemented.<VulnDiscussion>SQL Server backup is a critical step in maintaining data assurance and availability. - -User-level information is data generated by the information system and/or application users. In order to assure availability of this data in the event of a system failure, DoD organizations are required to ensure user-generated data is backed up at a defined frequency. This includes data stored on file systems, within SQL Server or within any other storage media. - -Applications performing backups must be configured to back up user-level information per the DoD-defined frequency. - -SQL Server Database backups provide the required means to restore databases after compromise or loss. Backups help reduce the vulnerability to unauthorized access or hardware loss.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000535Develop, document, and implement database backup procedures.Review the database backup procedures and implementation evidence. - -Evidence of implementation includes records of backup events and physical review of backup media. - -Evidence should match the backup plan as recorded in the system documentation. - -If backup procedures do not exist or are not implemented in accordance with the procedures, this is a finding.SRG-APP-000145-DB-000095<GroupDescription></GroupDescription>SQL2-00-017700SQL Server user-level information must be backed up based on a defined frequency.<VulnDiscussion>SQL Server backups are a critical step in maintaining data assurance and availability. - -User-level information is data generated by information system and/or application users. In order to assure availability of this data in the event of a system failure, DoD organizations are required to ensure user generated data is backed up at a defined frequency. This includes data stored on file systems, within SQL Server or within any other storage media. - -Applications performing backups must be capable of backing up user-level information per the DoD defined frequency. - -Databases that do not backup information regularly risk the loss of that information in the event of a system failure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000535Deploy a backup solution to perform backups as per organizationally defined Backup Policy.Windows Server Backup, or a 3rd Party Backup Tool, can be utilized to perform this function. Determine how SQL Server is being backed up. If there is no scheduled backup or if organizationally defined backup policy and procedures does not exist, this is finding. - -Check evidence of inclusion user-level information into current backup records, if the organizationally defined backup policy, procedures, and backup configurations is not including user-level information backups, this is a finding.SRG-APP-000144-DB-000101<GroupDescription></GroupDescription>SQL2-00-017500SQL Server must recover to a known state that is verifiable.<VulnDiscussion>Application recovery and reconstitution constitutes executing an information system contingency plan comprising activities that restore essential missions and business functions. - -SQL Server utilizes transaction-based processing and is a good example of information systems that are transaction-based. Transaction rollback and transaction journaling are examples of mechanisms supporting transaction recovery. - -SQL Server may be vulnerable to use of compromised data or other critical files during recovery. Use of compromised files could introduce maliciously altered application code, relaxed security settings, or loss of data integrity. SQL Server mechanisms must be configured to protect all files that could compromise the system or its data during a SQL Server recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000553Implement SQL Server recovery procedures to ensure the use of trusted files during SQL Server recovery. - -Modify the parameters for the transaction log file(s) for the system databases: - -Navigate to SQL Server Management Studio >> Object Explorer >> <SQL Server instance name> >> Databases >> System Databases >> right-click on <system database name> >> Properties >> Files. - -OR - -Modify the parameters for the transaction log file(s) for application databases: - -Navigate to SQL Server Management Studio >> Object Explorer >> <SQL Server instance name> >> Databases >> right-click on <user-defined database name> >> Properties >> Files. - -THEN - -Define additional space for the transaction log file, or extra transaction log files, as necessary. - -To modify Initial Size (MB), click in the "Initial Size (MB)" field for the log file in question, then edit the value. - -To modify Autogrowth, click on the "Autogrowth/Maxsize" button for the log file in question, choose "In Percent" or "In Megabytes", enter value, and then click OK. - -To modify Maximum File Size, click on the "Autogrowth/Maxsize" button for the log file in question, choose "Limited to (MB)", enter value, and then click OK. Do not select "Unlimited".Obtain the SQL Server recovery procedures and technical system features to determine if mechanisms exist and are in place to specify use of trusted files during SQL Server recovery. - -If recovery procedures do not exist or are not sufficient to ensure recovery is done in a secure and verifiable manner, this is a finding. - -Check the configurations of all transaction log files that are enabled by running the following SQL Server query: - -EXEC sp_MSforeachdb -' -SELECT ''?'' AS ''database name'' - , name AS ''log file name'' - , physical_name AS ''log file location and name'' - , state_desc - , size - , max_size - , growth - , is_percent_growth - FROM [?].sys.database_files - WHERE type_desc = ''LOG'' - AND state = 0; -' -; - -If any transaction log files are not configured correctly for size, max_size, and growth to log sufficient transaction information, this is a finding.SRG-APP-000142-DB-000094<GroupDescription></GroupDescription>SQL2-00-017400SQL Server must support the organizational requirements to specifically prohibit or restrict the use of unauthorized functions, ports, protocols, and/or services.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -Additionally, it is sometimes convenient to provide multiple services from a single component of an information system (e.g., email and web services) but doing so increases risk over limiting the services provided by any one component. - -To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. - -Database Management Systems using ports, protocols, and services deemed unsafe are open to attack through those ports, protocols, and services. This can allow unauthorized access to the database and, through the database, to other components of the information system. - -For detailed guidance on Ports, Protocols, and Services Management (PPSM), refer to the PPSM section of the Information Assurance Support Environment (IASE) web site, at http://iase.disa.mil/ppsm/Pages/index.aspx.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000382Disable functions, ports, protocols, and services that are not approved or are not used, but are enabled.Review the SQL Server configuration and settings for functions, ports, protocols, and services that are not approved or are not used, but are available. - -To determine the protocol(s) enabled for SQL Server, open SQL Server Configuration Manager. In the left-hand pane, expand SQL Server Network Configuration. Click on the entry for the SQL Server instance under review: "Protocols for <instance name>". The right-hand pane displays the protocols enabled for the instance. - -To determine whether SQL Server is configured to use a fixed port or dynamic ports, in the right-hand pane double-click on the TCP/IP entry, to open the Properties dialog. (The default fixed port is 1433.) - -To see which ports are open on the server, run netstat-a from a Windows command prompt. - -If any ports, protocols, and/or services that are not approved or are not used, are available, this is a finding.SRG-APP-000142-DB-000094<GroupDescription></GroupDescription>SQL2-00-017300SQL Server must specifically prohibit or restrict the use of unauthorized functions and services in each instance.<VulnDiscussion>SQL Server is capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -Additionally, it is sometimes convenient to provide multiple services from a single component of an information system (e.g., email and web services), but doing so increases risk over limiting the services provided by any one component.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000382To remove a function from SQL Server, run the following SQL Script: -DROP FUNCTION <'function name'> - -To remove a Stored Procedure from SQL Server, run the following SQL Script: -DROP PROCEDURE <'stored procedure name'> - -If the user-defined Stored Procedures and Functions need to remain available, but access needs to be more restricted, then the user-defined Stored Procedures and Functions should be moved to a separate schema or database that has more restrictive access.Review the list of user-defined Stored Procedures and Functions by running the following SQL query: -EXEC sp_MSforeachdb -' -DECLARE @nCount integer; - -SELECT @nCount = Count(*) - FROM [?].sys.objects - WHERE type in (''FN'', ''P'') - AND is_ms_shipped <> 1; - -IF @nCount > 0 -SELECT ''?'' AS ''Table Name'', * - FROM [?].sys.objects - WHERE type in (''FN'', ''P'') - AND is_ms_shipped <> 1; -' -; - -If any user-defined Stored Procedures and Functions are unauthorized and therefore should be prohibited or restricted and are not, this is a finding.SRG-APP-000141-DB-000093<GroupDescription></GroupDescription>SQL2-00-017200Access to xp_cmdshell must be disabled.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements; or providing a wide array of functionality not required for every mission, but which cannot be disabled. - -Applications must adhere to the principles of least functionality by providing only essential capabilities. - -DBMSs may spawn additional external processes to execute procedures that are defined in the DBMS, but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than the DBMS and provide unauthorized access to the host system. - -The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000381To disable the use of xp_cmdshell, from the query prompt: -EXEC sp_configure 'show advanced options', 1 -GO - -RECONFIGURE -GO - -EXEC sp_configure 'xp_cmdshell', 0 -GO - -RECONFIGURE -GOTo determine if xp_cmdshell is enabled, execute the following commands: - -EXEC SP_CONFIGURE 'show advanced option', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'xp_cmdshell'; - -If the value of config_value is 1, this is a finding.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL2-00-017100SQL Server default account sa must be disabled.<VulnDiscussion>SQL Server's 'sa' account has special privileges required to administer the database. The 'sa' account is a well-known SQL Server account and is likely to be targeted by attackers and thus more prone to providing unauthorized access to the database. - -This 'sa' default account is administrative and could lead to catastrophic consequences, including the complete loss of control over SQL Server. - -If the 'sa' default account is not disabled, an attacker might be able to gain access through the account. SQL Server by default, at installation, disables the 'sa' account. - -Some applications that run on SQL Server require the 'sa' account to be enabled in order for the application to function properly. These applications that require the 'sa' account to be enabled are usually legacy systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000381Modify the enabled flag of SQL Server's "sa" (sysadmin) account by running the following script. If the account name has been changed per SQL2-00-010200, replace the letters "sa" in the query with the new name. - -USE master; -GO -ALTER LOGIN [sa] DISABLE;Check SQL Server settings to determine if the 'sa' (sysadmin) account has been disabled by executing the following query: - -USE MASTER -GO -SELECT name, is_disabled -FROM sys.sql_logins -WHERE principal_id = 1; - -Verify that the "name" column contains the current name of the sa database server account (see note). - -If the "is_disabled" column is not set to 1, this is a finding. - -Note: If the 'sa' account name has been changed per SQL2-00-010200, its new name should appear in the query results.SRG-APP-000141-DB-000092<GroupDescription></GroupDescription>SQL2-00-017000Unused database components that are integrated in SQL Server and cannot be uninstalled must be disabled.<VulnDiscussion>SQL Server is capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations, or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled. - -Applications must adhere to the principles of least functionality by providing only essential capabilities. - -Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. Components of the system that are unused and cannot be uninstalled must be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000381If any components or features of SQL Server are required for operation of applications that will be accessing SQL Server data or configuration, include them in the system documentation. - -If any unused components or features of SQL Server are installed and cannot be uninstalled or removed, then disable those components or features.Review the components and features included in SQL Server and capable of being disabled (by configuration settings, permissions and privileges, etc.). Take note of those which are enabled. - -Review the system documentation to verify that the enabled components or features are documented and authorized. If any enabled components or features are not authorized, this is a finding.SRG-APP-000141-DB-000091<GroupDescription></GroupDescription>SQL2-00-016800SQL Server must have the SQL Server Analysis Service (SSAS) software component removed from SQL Server if SSAS is unused.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for applications to provide or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled. - -Applications must adhere to the principles of least functionality by providing only essential capabilities. - -Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. - -SQL Server must have the SQL Server Analysis Service (SSAS) software component removed from SQL Server if SSAS is unused.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000381Remove the SQL Server Analysis Service (SSAS) software component.If the SQL Server service "SQL Server Analysis Services (MSSQLSERVER)" is used and the service satisfies functional organizational requirement, this is not a finding. - -If there is no functional organizational requirement for the "SQL Server Analysis Services (MSSQLSERVER)" service make sure that the service is not installed or is disabled. - -From command prompt, using an account with System Administrator Privilege, open dcomcnfg. Navigate to Console Root >> Services (Local) >> [sort by name] >> locate: "SQL Server Analysis Services (MSSQLSERVER)". - -If the "SQL Server Analysis Services (MSSQLSERVER)" service does not exist, this is not a finding. - -If the "SQL Server Analysis Services (MSSQLSERVER)" status is "Started" or the "Startup Type" is not "Disabled", this is a finding.SRG-APP-000141-DB-000091<GroupDescription></GroupDescription>SQL2-00-016700SQL Server must have the SQL Server Integrated Services (SSIS) software component removed from SQL Server if SSIS is unused.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for applications to provide or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled. - -Applications must adhere to the principles of least functionality by providing only essential capabilities. - -Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. - -SQL Server must have the SQL Server Integrated Services (SSIS) software component removed from SQL Server if SSIS is unused.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000381Remove the SQL Server Integrated Services (SSIS) software component.If the SQL Server service "SQL Server Integration Services 11.0" is used and the service satisfies functional organizational requirement, this is not a finding. - -If there is no functional organizational requirement for the "SQL Server Integration Services 11.0" service make sure that the service is not installed or is disabled. - -From command prompt, using an account with System Administrator Privilege, open dcomcnfg. Navigate to Console Root >> Services (Local) >> [sort by name] >> locate: "SQL Server Integration Services 11.0". - -If the "SQL Server Integration Services 11.0" service does not exist, this is not a finding. - -If the "SQL Server Integration Services 11.0" status is "Started" or the "Startup Type" is not "Disabled", this is a finding.SRG-APP-000141-DB-000091<GroupDescription></GroupDescription>SQL2-00-016600SQL Server must have the SQL Server Reporting Service (SSRS) software component removed from SQL Server if SSRS is unused.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for applications to provide or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled. - -Applications must adhere to the principles of least functionality by providing only essential capabilities. - -Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. - -SQL Server must have the SQL Server Reporting Service (SSRS) software component removed from SQL Server if SSRS is unused.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000381Remove the SSRS from SQL Server.If there is no functional organizational requirement for the "SQL Server Reporting Services (MSSQLSERVER)" service, make sure that the service is not installed or that the service is disabled. - -If the SQL Server service "SQL Server Reporting Services (MSSQLSERVER)" is used and the service satisfies functional organizational requirement, this is not a finding. - - -From command prompt, using an account with System Administrator Privilege, open dcomcnfg. Navigate to Console Root >> Services (Local) >> [sort by name] >> locate: "SQL Server Reporting Services (MSSQLSERVER)". - -If the "SQL Server Reporting Services (MSSQLSERVER)" service does not exist, this is not a finding. - -If the "SQL Server Reporting Services (MSSQLSERVER)" status is "Started" or the "Startup Type" is not set to "Disabled", this is a finding.SRG-APP-000141-DB-000091<GroupDescription></GroupDescription>SQL2-00-016500SQL Server must have the SQL Server Data Tools (SSDT) software component removed from SQL Server if SSDT is unused.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled. - -Applications must adhere to the principles of least functionality by providing only essential capabilities. - -Unused and unnecessary DBMS components increase the attack vector for the DBMS by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. - - -SQL Server must have the SQL Server Data Tools (SSDT) software component removed from SQL Server if SSDT is unused.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000381Document the requirement for SQL Server Data Tools to reside on this server. - -If it is not required, using an account with System Administrator privileges, from Command Prompt, open control.exe. - -Navigate to Programs and Features. Remove the following entries in the 'Uninstall or change a program' window. - -Microsoft SQL Server Data Tools - Database Projects - Web installer entry point -Prerequisites for SSDTReview the list of components and features installed with the database. Using an account with System Administrator privileges, from Command Prompt, open control.exe. - -Navigate to Programs and Features. Check for the following entries in the 'Uninstall or change a program' window. - -Microsoft SQL Server Data Tools - Database Projects - Web installer entry point -Prerequisites for SSDT - -If SQL Server Data Tools is not documented as a server requirement, and these entries exist, this is a finding.SRG-APP-000141-DB-000090<GroupDescription></GroupDescription>SQL2-00-016300SQL Server must have the publicly available AdventureWorks sample database removed.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements and providing a wide array of functionality not required for every mission, but which cannot be disabled. - -Applications must adhere to the principles of least functionality by providing only essential capabilities. Even though the very popular "AdventureWorks" database is no longer available by default, it introduces a vulnerability to SQL Server and must be removed. - -Demonstration and sample database objects and applications present publicly known attack points for malicious users. These demonstration and sample objects are meant to provide simple examples of coding specific functions and are not developed to prevent vulnerabilities from being introduced to the SQL Server and the OS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000381Remove the publicly available "AdventureWorks" database from SQL Server by running the following query: - -DROP DATABASE AdventureWorksCheck SQL Server for the existence of the publicly available "AdventureWorks" database by performing the following query: - -SELECT name from sysdatabases where name like 'AdventureWorks%'; - -If the "AdventureWorks" database is present, this is a finding.SRG-APP-000141-DB-000090<GroupDescription></GroupDescription>SQL2-00-016200SQL Server must have the publicly available NorthWind sample database removed.<VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements and providing a wide array of functionality not required for every mission, but which cannot be disabled. - -Applications must adhere to the principles of least functionality by providing only essential capabilities. Even though the very popular "NorthWind" database is no longer available by default, it introduces a vulnerability to SQL Server and must be removed. - -Demonstration and sample database objects and applications present publicly known attack points for malicious users. These demonstration and sample objects are meant to provide simple examples of coding specific functions and are not developed to prevent vulnerabilities from being introduced to the SQL Server and the OS.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000381Remove the publicly available "Northwind" database from SQL Server by running the following query: - - -DROP DATABASE NorthwindCheck SQL Server for the existence of the publicly available "NorthWind" database by performing the following query: - -SELECT name from sysdatabases where name like 'Northwind%'; - -If the "Northwind" database is present, this is a finding.SRG-APP-000133-DB-000207<GroupDescription></GroupDescription>SQL2-00-015800The OS must limit privileges to change SQL Server software resident within software libraries (including privileged programs).<VulnDiscussion>When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. - -If any user were allowed to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. The DBMS software libraries contain the executables used by the DBMS to operate. Unauthorized access to the libraries can result in compromised installations. This may in turn jeopardize data stored in the DBMS and/or operation of the host system. - -Accordingly, only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. - -Of particular note in this context is that any software installed for auditing and/or audit file management must be protected and monitored.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001493CCI-001494CCI-001495CCI-001499Navigate to the SQL Server software directory (\binn) location. Right-click the folder, click Properties. On the Security tab, modify the security permissions, so that files and folders that are part of the SQL Server 2012 installation have at most the following privileges. Right-click each folder under the installation folder, click Properties. On the Security tab, modify the security permissions, so that at most the following permissions are present: -Trusted Installer (Full Control) -CREATOR OWNER (Full Control) -SYSTEM (Full Control) -Administrators (Full Control) [See Note 3] -Users (Read, List Folder Contents, Read & Execute) -Creator Owner (Special Permissions - Full control - Subfolders and files only) -All Application Packages (Read & Execute) [Only as needed - see Note 4] -SQL Server Service SID OR Service Account (Read & Execute) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Full Control) [Notes 1, 2] -SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read & Execute) [Notes 1, 2] -System Administrators (Full Control) [Note 3] -Repeat the above for the \Install folder. - -Navigate to the ...\Microsoft SQL Server\110\Shared folder. On the Security tab, modify the security permissions, so that at most the following permissions are present: -Trusted Installer (Full Control) -CREATOR OWNER (Full Control) -System (Full Control) -SQL Server Service SID OR Service Account (Read & Execute) [Notes 1, 2] -System Administrators (Full Control) [Note 3] -Local Administrators (Read) -SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read & Execute) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] -SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Write) [Notes 1, 2] -Users (Read, List Folder Contents, Read & Execute) -[MsDtsServer110 (Read & Execute) is also permitted, if SSIS/DTS is in use.] -[NT AUTHORITY\NETWORK SERVICE (Read & Execute) may also be required for SQL Server Configuration Manager to operate.] - ------ - -Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control because these permissions are available only to the specific service when it is running and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.110).aspx. - -Note 2: Tips for adding a service SID/virtual account to a folder's permission list. -1) In Windows Explorer, right-click on the folder and select "Properties." -2) Select the "Security" tab -3) Click "Edit" -4) Click "Add" -5) Click "Locations" -6) Select the computer name -7) Search for the name -7.a) SQL Server Service -7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) -7.a.ii) Select the "MSSQL$<instance name>" user and click "OK" -7.b) SQL Agent Service -7.b.i) Type "NT SERVICE\SQL" and click "Check Names" -7.b.ii) Select the "SQLAgent$<instance name>" user and click "OK" -8) Click "OK" -9) Permission like a normal user from here - -Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only. - -Note 4: Some files also require 'ALL APPLICATION PACKAGES (READ, EXECUTE)' permissions for certain functionality to work appropriately, and this is considered acceptable where those permissions are required. (All SQL Server files that require this access reside by default in the ..\Microsoft SQL Server\110\ directory.)Obtain the SQL Server software directory location: from a command prompt, open the registry editor by typing regedit.exe and pressing [ENTER]. Navigate to the following registry location: -HKEY_LOCAL_MACHINE ->> SOFTWARE ->> Microsoft ->> Microsoft SQL Server ->> [INSTANCE NAME] ->> Setup ->> SQLBinRoot - -In the registry tree, the [INSTANCE NAME] for a SQL Server 2012 database engine instance is normally shown as "MSSQL11" followed by a period and the name that was specified for the SQL Server service at installation time. If multiple SQL Server instances are installed, each will have its own [INSTANCE NAME] node and subtree in the registry. - -The value in the Data column for the SQLBinRoot registry entry is the file system path for the SQL Server 2012 binaries. Navigate to that folder location using a command prompt or Windows Explorer. The following instructions assume that Windows Explorer is used. - -Verify that files and folders that are part of the SQL Server 2012 instance have only authorized privileges. Right-click the binaries (\binn) folder, click Properties. On the Security tab, verify that at most the following permissions are present: -Trusted Installer (Full Control) -CREATOR OWNER (Full Control) -SYSTEM (Full Control) -Administrators (Full Control) [See Note 3] -Users (Read, List Folder Contents, Read & Execute) -Creator Owner (Special Permissions - Full control - Subfolders and files only) -All Application Packages (Read & Execute) [Only as needed - see Note 4] -SQL Server Service SID OR Service Account (Read & Execute) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Full Control) [Notes 1, 2] -SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read & Execute) [Notes 1, 2] -System Administrators (Full Control) [Note 3] - -If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - -Right-click each folder under the binaries folder; click Properties. On the Security tab, verify that at most the permissions listed in the preceding paragraph are present. -If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - -Right-click the \Install folder, which is a peer of \binn, under ...\MSSQL. On the Security tab, verify that at most the permissions listed in the preceding paragraphs are present. If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - - -Locate the ...\Microsoft SQL Server\110\Shared folder, either by stepping up the tree in Windows Explorer or by finding the file path in the registry at: -HKEY_LOCAL_MACHINE ->> SOFTWARE ->> Microsoft ->> Microsoft SQL Server ->> 110 ->> SharedCode - -Right-click on the ...\110\Shared folder; click Properties. On the Security tab, verify that at most the following permissions are present: -Trusted Installer (Full Control) -CREATOR OWNER (Full Control) -System (Full Control) -SQL Server Service SID OR Service Account (Read & Execute) [Notes 1, 2] -System Administrators (Full Control) [Note 3] -Local Administrators (Read) -SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read & Execute) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] -SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Write) [Notes 1, 2] -Users (Read, List Folder Contents, Read & Execute) -[MsDtsServer110 (Read & Execute) is also permitted, if SSIS/DTS is in use.] -[NT AUTHORITY\NETWORK SERVICE (Read & Execute) may also be required for SQL Server Configuration Manager to operate.] - -If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - -Right-click each folder under the ...\110\Shared folder; click Properties. On the Security tab, verify that at most the permissions listed in the preceding paragraph are present. If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - ------ - -Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control because these permissions are available only to the specific service when it is running and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.110).aspx. - -Note 2: Tips for adding a service SID/virtual account to a folder's permission list. -1) In Windows Explorer, right-click on the folder and select "Properties." -2) Select the "Security" tab -3) Click "Edit" -4) Click "Add" -5) Click "Locations" -6) Select the computer name -7) Search for the name -7.a) SQL Server Service -7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) -7.a.ii) Select the "MSSQL$<instance name>" user and click "OK" -7.b) SQL Agent Service -7.b.i) Type "NT SERVICE\SQL" and click "Check Names" -7.b.ii) Select the "SQLAgent$<instance name>" user and click "OK" -8) Click "OK" -9) Permission like a normal user from here - -Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only. - -Note 4: Some files also require 'ALL APPLICATION PACKAGES (READ, EXECUTE)' permissions for certain functionality to work appropriately, and this is considered acceptable where those permissions are required. (All SQL Server files that require this access reside by default in the ..\Microsoft SQL Server\110\ directory.) -SRG-APP-000133-DB-000205<GroupDescription></GroupDescription>SQL2-00-015700Vendor-supported software and patches must be evaluated and patched against newly found vulnerabilities.<VulnDiscussion>Security faults with software applications and operating systems are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. - -Any time new software code is introduced to a system there is the potential for unintended consequences. There have been documented instances where the application of a patch has caused problems with system integrity or availability. Due to information system integrity and availability concerns, organizations must give careful consideration to the methodology used to carry out automatic updates. - -If SQL Server were no longer supported, no patches from Microsoft would address newly discovered security vulnerabilities. Unpatched software is vulnerable to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001499Upgrade SQL Server to the Microsoft-supported version. - -Apply the latest SQL Server patches after evaluation of impact.Check Microsoft's list of supported SQL Server versions. To locate the correct web page, perform a web search for "Microsoft SQL Server end of support." - -To be considered supported, Microsoft must report that the version is supported by security patches to known vulnerabilities. - -Check SQL Server version by running the following command: -print @@version - -If the security patch support for SQL Server cannot be determined or SQL Server version is not shown as supported, this is a finding. - -If SQL Server does not contain the latest security patches, this is a finding.SRG-APP-000133-DB-000199<GroupDescription></GroupDescription>SQL2-00-015500Database software directories, including SQL Server configuration files, must be stored in dedicated directories, separate from the host OS and other applications.<VulnDiscussion>When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. - -Multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit of one application can lead to an exploit of other applications sharing the same security context. For example, an exploit of a web server process that leads to unauthorized administrative access to host system directories can most likely lead to a compromise of all applications hosted by the same system. Database software not installed using dedicated directories both threatens and is threatened by other hosted applications. Access controls defined for one application may by default provide access to other applications’ database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001499Separate database files (software, data) into dedicated directories.Verify the SQL Server installations present on the server. - -From a Command Prompt, type regedit.exe, and press [ENTER]. - -Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Microsoft SQL Server >> Instance Names. Each instance installed on the server possesses a key inside a folder under this registry entry. - -Analysis Services Instances are registered in the OLAP subfolder. -Reporting Services Instances are registered in the RS subfolder. -Standard SQL Server Instances are registered in the SQL subfolder. - -Inside each of these folders, a single key is used to reference an Instance's specific Windows Registry tree. Each key will have its own registry tree at the following registry location: - -HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Microsoft SQL Server >> [INSTANCE NAME]. - -An [INSTANCE NAME] is listed as the Data component of a key found in one of the above OLAP, RS, or SQL folders. - -To find the installation location of a particular instance, navigate to the following location in the Windows Registry: - -HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Microsoft SQL Server >> [INSTANCE NAME] >> Setup. - -Examine the value of the 'SqlProgramDir' key. The value of the 'SqlProgramDir' key is the SQL Server installation directory for that SQL Server Instance. - -Navigate to that folder location using a Command Prompt or Windows Explorer. Only applications that are required for the functioning and administration, not use, of the SQL Server should be located on the same directory node as the SQL Server software libraries. - -If any files or subfolders that are not part of the SQL Server installation are in the folder, this is a finding.SRG-APP-000133-DB-000198<GroupDescription></GroupDescription>SQL2-00-015400SQL Server software installation account(s) must be restricted to authorized users.<VulnDiscussion>When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. - -If the application were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. - -This requirement is contingent upon the language in which the application is programmed, as many application architectures in use today incorporate their software libraries into, and make them inseparable from, their compiled distributions, rendering them static and version dependant. However, this requirement does apply to applications with software libraries accessible and configurable, as in the case of interpreted languages. - -Accordingly, only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. - -DBA and other privileged administrative or application owner accounts are granted privileges that allow actions that can have a greater impact on SQL Server security and operation. It is especially important to grant access to privileged accounts to only those persons who are qualified and authorized to use them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001499From a Command Prompt, open lusrmgr.msc. Navigate to Users >> right click individual user >> Properties >> Member Of. - - -Configure SQL Server & OS settings and access controls, to restrict user access to objects and data that the user is authorized to view or interact with. - -Develop, document, and implement procedures to restrict use of the DBMS software installation account.Check system documentation for policy and procedures to restrict use of the SQL Server software installation account. - - -Check OS settings to determine whether users are restricted from accessing SQL Server objects and data they are not authorized to access by checking the local OS user accounts. -From a Command Prompt, open lusrmgr.msc. Navigate to Users >> right click individual user >> Properties >> Member Of. - - -If appropriate access controls for all users are not implemented to restrict access to only authorized users and to restrict the access of those users to objects and data they are authorized, this is a finding. - - -Review procedures for controlling and granting access to use of the SQL Server software installation account. - -If access or use of this account is not restricted to the minimum number of personnel required, or unauthorized access to this account has been granted, this is a finding.SRG-APP-000133-DB-000179<GroupDescription></GroupDescription>SQL2-00-015350Software, applications, and configuration files that are part of, or related to, the SQL Server 2012 installation must be monitored to discover unauthorized changes.<VulnDiscussion>When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of applications and tools related to SQL Server can potentially have significant effects on the overall security of the system. Only qualified and authorized individuals shall be allowed to obtain access to components related to SQL Server for purposes of initiating changes, including upgrades and modifications. - -Unmanaged changes that occur to the software libraries or configuration can lead to unauthorized or compromised installations. - -Of particular note in this context is that any software installed for auditing and/or audit file management must be protected and monitored. -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001297CCI-001493CCI-001494CCI-001495Include locations of all files, libraries, scripts, and executables that are part of, or related to, the SQL Server 2012 installation in the documentation. - -Deploy a security and data integrity tool for monitoring and alerting files and folders based on cryptographic hashes, to verify files/folder locations as listed in the documentation.If a security and data integrity tool is not used for monitoring and alerting files and folders based on cryptographic hashes, this is a finding. - -If the tool does not verify files/folder locations as listed in the documentation, this is a finding.SRG-APP-000133-DB-000179<GroupDescription></GroupDescription>SQL2-00-015300SQL Server must monitor for security-relevant configuration settings to discover unauthorized changes.<VulnDiscussion>When dealing with change control issues, it should be noted, any changes to security-relevant configuration settings of SQL Server can potentially have significant effects on the overall security of the system. - -If SQL Server were to allow any user to make changes to configuration settings, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. This requirement is contingent upon the configuration of SQL Server's hosted application and the security-relevant configuration settings of SQL Server. - -Accordingly, only qualified and authorized individuals shall be allowed to obtain access to these security-relevant configuration settings for purposes of initiating changes, including upgrades and modifications. - -Unmanaged changes that occur to SQL Server software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001499Document the monitoring of security-relevant configuration settings to discover unauthorized changes within the system documentation. - -Document the specific users or types of security personnel that are able to monitor security-relevant configuration settings to discover unauthorized changes. - -Deploy and implement a third-party tool or some other SQL Server method of monitoring security-relevant configuration settings to discover unauthorized changes.Verify within the system documentation that SQL Server is monitoring for security-relevant configuration settings to discover unauthorized changes. - -This can be done by a third-party tool or a SQL script that does baselining and then comparisons. - -If the monitoring of security-relevant configuration settings to discover unauthorized changes is not implemented on SQL Server, this is a finding.SRG-APP-000130-DB-000088<GroupDescription></GroupDescription>SQL2-00-014700SQL Server must support the employment of automated mechanisms supporting the auditing of the enforcement actions.<VulnDiscussion>Any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. - -Accordingly, only qualified and authorized individuals are allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. - -Access restrictions for change also include software libraries. - -Examples of access restrictions include: physical access controls (such as locks and access cards), logical access controls (such as ACLs), automated auditing (logging) of logical access, workflow automation, media libraries, abstract layers (e.g., changes are implemented into a third-party interface rather than directly into the information system component), and change windows (e.g., changes occur only during specified times, making unauthorized changes outside the window easy to discover). - -This requirement focuses on the auditing aspect of the protections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000347Navigate to Advanced Security Settings by selecting Properties > Security > Advanced > Auditing > Continue. - -Where "Everyone" is missing from the "Name" column, click the Add button; type "Everyone" in the object names box; click the OK button. The Auditing Entry dialog opens. - -Where "Everyone" is in the "Name" column, select that row and click on the Edit button. The Auditing Entry dialog opens. - -In the Auditing Entry dialog, set "Apply onto" to "This folder, subfolders and files". - -In the Auditing Entry dialog, select both the Successful and the Failed checkbox for each of the following access types, where not already selected: - Traverse folder/execute file - List folder/read data - Read attributes - Read extended attributes - Create files/write data - Create folders/append data - Write attributes - Write extended attributes - Delete - Read permissions - -Click OK, OK, OK, OK to save the new settings and exit the dialog boxes.Verify that Files and Folders that are part of the SQL Server 2012 Installation have auditing enabled. - -Right click the root folder of the SQL Server installation. Typically, this is at <drive>:\Program Files\Microsoft SQL Server\. Select Properties. - -Click on the Security tab - -Click on the Advanced button - -Click on the Auditing tab - -If "Everyone" is not listed in the "Name" column, this is a finding. - -If "This folder, subfolders and files" is not listed in the "Apply To" column, this is a finding. - -When "Everyone" ... " is listed, select the "Everyone" row and click on the Edit button. - -If either the Successful or Failed checkbox is not selected for any of the following access types, this is a finding: - Traverse folder/execute file - List folder/read data - Read attributes - Read extended attributes - Create files/write data - Create folders/append data - Write attributes - Write extended attributes - Delete - Read permissionsSRG-APP-000129-DB-000087<GroupDescription></GroupDescription>SQL2-00-014600SQL Server must support the organizational requirement to employ automated mechanisms for enforcing access restrictions.<VulnDiscussion>When dealing with access restrictions pertaining to change control, it should be noted, any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. - -Only qualified and authorized individuals are allowed to obtain access to information system components for the purposes of initiating changes, upgrades, and modifications. - -Access restrictions for change also include application software libraries. - -Examples of access restrictions include: physical and logical access controls, workflow automation, media libraries, abstract layers (i.e., changes are implemented into a third-party interface rather than directly into the information system component), and change windows (i.e., changes occur only during specified times, making unauthorized changes outside the window easy to discover). - -Multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit of one application can lead to an exploit of other applications sharing the same security context. For example, an exploit of a web server process that leads to unauthorized administrative access to host system directories can most likely lead to a compromise of all applications hosted by the same system. Database software not installed using dedicated directories both threatens, and is threatened by, other hosted applications. Access controls defined for one application may, by default, provide access to other applications’ database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000346Install SQL Server software using directories separate from the OS and other application software library directories. - -Relocate any directories or reinstall other application software that currently shares the DBMS software library directory to separate directories. - -Recommend dedicating a separate partition for the SQL software libraries.Obtain the SQL Server software library installation directory location. - -From a command prompt, type regedit.exe, and press [ENTER]. - -Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Microsoft SQL Server >> Instance Names. Each instance installed on the server possesses a key inside a folder under this registry entry. - -Analysis Services Instances are registered in the OLAP subfolder. -Reporting Services Instances are registered in the RS subfolder. -Standard SQL Server Instances are registered in the SQL subfolder. - -Inside each one of these folders, a single key is used to reference an instance's specific Windows Registry tree. Each key will have its own registry tree at the following registry location: HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Microsoft SQL Server >> [INSTANCE NAME]. - -An [INSTANCE NAME] is listed as the data component of a key found in one of the above OLAP, RS, or SQL folders. - -To find the installation location of a particular instance, navigate to the following location in the Windows Registry: - HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Microsoft SQL Server >> [INSTANCE NAME] >> Setup. Examine the value of the 'SqlProgramDir' key. The value of the 'SqlProgramDir' key is the SQL Server installation directory for that SQL Server Instance. - -Navigate to that folder location using a command prompt or Windows Explorer. Note any custom subdirectories within the SQL Server software library directory. Only applications that are required for the functioning and administration of SQL Server should be located in the same disk directory as the SQL Server software libraries. - -If any directories or files not installed with the SQL Server software exist within the SQL Server software library directory, this is a finding.SRG-APP-000120-DB-000061<GroupDescription></GroupDescription>SQL2-00-013800SQL Server must protect audit information from unauthorized deletion.<VulnDiscussion>If audit data were to become compromised, competent forensic analysis and discovery of the true source of potentially malicious system activity would be impossible to achieve. - -To ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized deletion. This requirement can be achieved through multiple methods, which will depend upon system architecture and design. - -Some commonly employed methods include ensuring log files enjoy the proper file system permissions utilizing file system protections, restricting access, and backing up log data to ensure log data is retained. - -Applications providing a user interface to audit data will leverage user permissions and roles identifying the user accessing the data and the corresponding rights the user enjoys in order to make decisions regarding the deletion of audit data. - -Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. - -Deletion of database audit data could mask the theft or unauthorized modification of sensitive data stored in the database.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000164Modify audit file permissions to meet the requirement to protect against unauthorized deletion. - -Navigate to audit folder location(s) using a command prompt or Windows Explorer. Right-click on the file, click Properties. -On the Security tab, modify the security permissions to: -Administrator(read) -Users (none) -Audit Administrator(Full Control) -Auditors group (Read) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] - ------ - -Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically-generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control, because these permissions are available only to the specific service when it is running, and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.110).aspx. - - -Note 2: Tips for adding a service SID/virtual account to a folder's permission list. -1) In Windows Explorer, right-click on the folder and select "Properties." -2) Select the "Security" tab -3) Click "Edit" -4) Click "Add" -5) Click "Locations" -6) Select the computer name -7) Search for the name -7.a) SQL Server Service -7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) -7.a.ii) Select the "MSSQL$<instance name>" user and click OK -7.b) SQL Agent Service -7.b.i) Type "NT SERVICE\SQL" and click "Check Names" -7.b.ii) Select the "SQLAgent$<instance name>" user and click OK -8) Click OK -9) Permission like a normal user from hereObtain the SQL Server audit file location(s) by running the following SQL script: -SELECT DISTINCT -LEFT(path, (LEN(path) - CHARINDEX('\',REVERSE(path)) + 1)) AS "Audit Path" -FROM sys.traces -UNION -SELECT log_file_path AS "Audit Path" -FROM sys.server_file_audits - -For each audit, the path column will give the location of the file. - -Verify that all audit files have the correct permissions by doing the following for each audit file: Navigate to audit folder location(s) using a command prompt or Windows Explorer. - -Right-click the file/folder, click Properties. On the Security tab, verify that at most the following permissions are applied: -Administrator(read) -Users (none) -Audit Administrator (Full Control) -Auditors group (Read) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] - -If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding. - -If less restrictive permissions are present and specifically justified and approved in the system security plan, this is not a finding ------ - -Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically-generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control, because these permissions are available only to the specific service when it is running, and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.120).aspx. - -Note 2: Tips for adding a service SID/virtual account to a folder's permission list. -1) In Windows Explorer, right-click on the folder and select "Properties." -2) Select the "Security" tab -3) Click "Edit" -4) Click "Add" -5) Click "Locations" -6) Select the computer name -7) Search for the name -7.a) SQL Server Service -7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) -7.a.ii) Select the "MSSQL$<instance name>" user and click OK -7.b) SQL Agent Service -7.b.i) Type "NT SERVICE\SQL" and click "Check Names" -7.b.ii) Select the "SQLAgent$<instance name>" user and click OK -8) Click OK -9) Permission like a normal user from hereSRG-APP-000119-DB-000060<GroupDescription></GroupDescription>SQL2-00-013700SQL Server must protect audit information from unauthorized modification.<VulnDiscussion>If audit data were to become compromised, competent forensic analysis and discovery of the true source of potentially malicious system activity would be impossible to achieve. - -To ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized modification. - -This requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files enjoy the proper file system permissions, and limiting log data locations. - -Applications providing a user interface to audit data will leverage user permissions and roles identifying the user accessing the data and the corresponding rights that the user enjoys in order to make decisions regarding the modification of audit data. - -Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. - -Modification of database audit data could mask the theft or unauthorized modification of sensitive data stored in the database.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000163Edit the system security plan to include justification and authorization for any less restrictive permissions that are present and needed. (An example might be where Auditors need "Read & Execute" rather than "Read" alone.) - -Modify audit file permissions to meet the requirement to protect against unauthorized modification. - -Navigate to audit folder location(s) using a command prompt or Windows Explorer. Right-click on the file, click Properties. On the Security tab, modify the security permissions to: -Administrator(read) -Users (none) -Audit Administrator(Full Control) -Auditors group (Read) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] - ------ - -Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically-generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control, because these permissions are available only to the specific service when it is running, and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.110).aspx. - - -Note 2: Tips for adding a service SID/virtual account to a folder's permission list. -1) In Windows Explorer, right-click on the folder and select "Properties." -2) Select the "Security" tab -3) Click "Edit" -4) Click "Add" -5) Click "Locations" -6) Select the computer name -7) Search for the name -7.a) SQL Server Service -7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) -7.a.ii) Select the "MSSQL$<instance name>" user and click OK -7.b) SQL Agent Service -7.b.i) Type "NT SERVICE\SQL" and click "Check Names" -7.b.ii) Select the "SQLAgent$<instance name>" user and click OK -8) Click OK -9) Permission like a normal user from hereObtain the SQL Server audit file location(s) by running the following SQL script: -SELECT DISTINCT -LEFT(path, (LEN(path) - CHARINDEX('\',REVERSE(path)) + 1)) AS "Audit Path" -FROM sys.traces -UNION -SELECT log_file_path AS "Audit Path" -FROM sys.server_file_audits - -For each audit, the Audit Path column will give the location of the file. - -Verify that all audit files have the correct permissions by doing the following for each audit file: Navigate to audit folder location(s) using a command prompt or Windows Explorer. The following instructions assume Windows Explorer is used. - -Right-click the file/folder, click Properties. On the Security tab, verify that at most the following permissions are applied: -Administrator(read) -Users (none) -Audit Administrator (Full Control) -Auditors group (Read) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] - -If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding. - -If less restrictive permissions are present and specifically justified and approved in the system security plan, this is not a finding. - -If Trace is in use, SQL Server creates each trace file with a standard set of permissions, overriding the folder permissions. It grants full control to OWNER RIGHTS, Administrators and <SQL Server Instance name>. Since this is not configurable, this is not a finding.SRG-APP-000118-DB-000059<GroupDescription></GroupDescription>SQL2-00-013600SQL Server must protect audit information from any type of unauthorized access.<VulnDiscussion>If audit data were to become compromised, competent forensic analysis and discovery of the true source of potentially malicious system activity would be difficult, if not impossible, to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage. - -To ensure the veracity of audit data, the information system and/or the application must protect audit information from any and all unauthorized access. This includes read, write, copy, etc. - -SQL Server and third-party tools are examples of applications that are easily able to view and manipulate audit file data. Additionally, applications with user interfaces to audit records should not allow unfettered manipulation of, or access to, those records via any application. If an application provides access to the audit data, the application becomes accountable for ensuring that audit information is protected from unauthorized access. - -This requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files enjoy the proper file system permissions utilizing file system protections, and limiting log data location. - -Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000162Edit the system security plan to include justification and authorization for any less restrictive permissions that are present and needed. (An example might be where Auditors need "Read & Execute" rather than "Read" alone.) - -Modify audit file permissions to meet the requirement to protect against unauthorized access. - -Navigate to audit folder location(s) using a command prompt or Windows Explorer. Right-click on the file, click Properties. -On the Security tab, modify the security permissions to: -Administrator(read) -Users (none) -Audit Administrator(Full Control) -Auditors group (Read) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] - - ------ - -Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically-generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control, because these permissions are available only to the specific service when it is running, and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.110).aspx. - - -Note 2: Tips for adding a service SID/virtual account to a folder's permission list. -1) In Windows Explorer, right-click on the folder and select "Properties." -2) Select the "Security" tab -3) Click "Edit" -4) Click "Add" -5) Click "Locations" -6) Select the computer name -7) Search for the name -7.a) SQL Server Service -7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) -7.a.ii) Select the "MSSQL$<instance name>" user and click OK -7.b) SQL Agent Service -7.b.i) Type "NT SERVICE\SQL" and click "Check Names" -7.b.ii) Select the "SQLAgent$<instance name>" user and click OK -8) Click OK -9) Permission like a normal user from hereObtain the SQL Server audit file location(s) by running the following SQL script: -SELECT DISTINCT -LEFT(path, (LEN(path) - CHARINDEX('\',REVERSE(path)) + 1)) AS "Audit Path" -FROM sys.traces -UNION -SELECT log_file_path AS "Audit Path" -FROM sys.server_file_audits - -For each audit, the path column will give the location of the file. - -Verify that all audit files have the correct permissions by doing the following for each audit file: Navigate to audit folder location(s) using a command prompt or Windows Explorer. - -Right-click the file/folder, click Properties. On the Security tab, verify that at most the following permissions are applied: -Administrator(read) -Users (none) -Audit Administrator (Full Control) -Auditors group (Read) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] - - -If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding. - -If less restrictive permissions are present and specifically justified and approved in the system security plan, this is not a finding. - ------ - -Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically-generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control, because these permissions are available only to the specific service when it is running, and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.120).aspx. - -Note 2: Tips for adding a service SID/virtual account to a folder's permission list. -1) In Windows Explorer, right-click on the folder and select "Properties." -2) Select the "Security" tab -3) Click "Edit" -4) Click "Add" -5) Click "Locations" -6) Select the computer name -7) Search for the name -7.a) SQL Server Service -7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) -7.a.ii) Select the "MSSQL$<instance name>" user and click OK -7.b) SQL Agent Service -7.b.i) Type "NT SERVICE\SQL" and click "Check Names" -7.b.ii) Select the "SQLAgent$<instance name>" user and click OK -8) Click OK -9) Permission like a normal user from hereSRG-APP-000127-DB-000172<GroupDescription></GroupDescription>SQL2-00-014400SQL Server must protect the audit records generated as a result of remote access to privileged accounts and by the execution of privileged functions.<VulnDiscussion>Protection of audit records and audit data is of critical importance. Care must be taken to ensure privileged users cannot circumvent audit protections put in place. - -Auditing might not be reliable when performed by an information system that the user being audited has privileged access to. - -The privileged user could inhibit auditing or directly modify audit records. To prevent this from occurring, privileged access shall be further defined between audit-related privileges and other privileges, thus limiting the users with audit-related privileges. - -Reducing the risk of audit compromises by privileged users can also be achieved, for example, by performing audit activity on a separate information system where the user in question has limited access, or by using storage media that cannot be modified (e.g., write-once recording devices). - -If an attacker were to gain access to audit tools, they could analyze audit logs for system weaknesses or weaknesses in the auditing itself. An attacker could also manipulate logs to hide evidence of malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001352Modify audit file permissions to meet the requirement to protect against unauthorized access. - -Navigate to the audit folder location(s) using a command prompt or Windows Explorer. Right-click on the file, click Properties. -On the Security tab, modify the security permissions to: -Administrator(read) -Users (none) -Audit Administrator(Full Control) -Auditors group (Read) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] - ------ - -Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically-generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control, because these permissions are available only to the specific service when it is running, and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.110).aspx. - - -Note 2: Tips for adding a service SID/virtual account to a folder's permission list. -1) In Windows Explorer, right-click on the folder and select "Properties." -2) Select the "Security" tab -3) Click "Edit" -4) Click "Add" -5) Click "Locations" -6) Select the computer name -7) Search for the name -7.a) SQL Server Service -7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) -7.a.ii) Select the "MSSQL$<instance name>" user and click OK -7.b) SQL Agent Service -7.b.i) Type "NT SERVICE\SQL" and click "Check Names" -7.b.ii) Select the "SQLAgent$<instance name>" user and click OK -8) Click OK -9) Permission like a normal user from hereObtain the SQL Server audit file location(s) by running the following SQL script: -SELECT DISTINCT -LEFT(path, (LEN(path) - CHARINDEX('\',REVERSE(path)) + 1)) AS "Audit Path" -FROM sys.traces -UNION -SELECT log_file_path AS "Audit Path" -FROM sys.server_file_audits - -For each audit, the path column will give the location of the file. - -Verify that all audit files have the correct permissions by doing the following for each audit file: Navigate to audit folder location(s) using a command prompt or Windows Explorer. - -Right-click the file/folder, click Properties. On the Security tab, verify that at most the following permissions are applied: -Administrator(read) -Users (none) -Audit Administrator (Full Control) -Auditors group (Read) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] -If any less restrictive permissions are present (and not specifically justified and approved), this is a finding.SRG-APP-000115-DB-000056<GroupDescription></GroupDescription>SQL2-00-013400SQL Server must audit attempts to bypass access controls.<VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. - -Detection of suspicious activity, including access attempts and successful access from unexpected places, during unexpected times, or other unusual indicators, can support decisions to apply countermeasures to deter an attack. Without detection, malicious activity may proceed without hindrance. In SQL Server's case, this is a combination of the standard audit trace, as well as the operating system logs. Only the SQL Server logs are validated for this check, as the other part is dependent upon the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000158Create a trace that meets all auditing requirements. - -The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.Check to see that all required events are being audited. -From the query prompt: - SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); -All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. - -Determine the trace(s) being used for the auditing requirement. -In the following, replace # with a trace ID being used for the auditing requirements. -From the query prompt: - SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); -The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, - 170, 171, 172, 173, 175, 176, 177, 178. -If any of the audit event IDs required above is not listed, this is a finding. - -Notes: -1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. -2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. -3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) -Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; -5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. -6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.SRG-APP-000107-DB-000169<GroupDescription></GroupDescription>SQL2-00-012800SQL Server must shutdown immediately in the event of an audit failure, unless an alternative audit capability exists.<VulnDiscussion>It is critical that, when SQL Server is at risk of failing to process audit logs as required, it takes action to mitigate the failure. If the system were to continue processing without auditing enabled, actions could be taken on the system that could not be tracked and recorded for later forensic analysis. - -In many system configurations, the disk space allocated to the auditing system is separate from the disks allocated for the operating system; therefore, this may not result in a system outage. This places the onus on the DBMS to detect and take actions. - -A failure of SQL Server auditing will result in either the database continuing to function without auditing, or the halting of SQL Server operations. In this case, the database must cease processing immediately in order to not allow unlogged transaction to occur. - -Note that trace file rollover does not count as an audit failure, provided that the system is also configured to shut down when it runs out of space. Trace file rollover can be a useful technique for breaking the log into manageable pieces, for archiving, or for transfer to a log management system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001343If a trace does not exist, create a trace specification that complies with requirements. - -If a trace exists, but is not set to SHUTDOWN_ON_ERROR, modify the SQL Server audit setting to immediately shutdown the database in the event of an audit failure by setting property 1 to a value of 4 or 6 for the audit. - -(See the SQL Server Help page for sys.sp_trace_create for implementation details.)From the query prompt: - -SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); - -All currently defined traces for the SQL Server instance will be listed. If no traces are returned, this is a finding. - -Determine the trace being used for the auditing requirement. Replace # in the following code with a traceid being used for the auditing requirements. - -From the query prompt, determine whether the trace options include the value 4, which means SHUTDOWN_ON_ERROR: -SELECT CAST(value AS INT) -FROM sys.fn_trace_getinfo(#) -where property = 1; - -If the query does not return a value, this is a finding. -If a value is returned but is not 4 or 6, this is a finding. -(6 represents the combination of values 2 and 4. 2 means TRACE_FILE_ROLLOVER.) - - -NOTE: Microsoft has flagged the trace techniques and tools used in this STIG as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use and configured to satisfy this requirement, this is not a finding. The following code can be used to check Extended Events settings. -/********************************** -Check to verify shutdown on failure is set. -The following settings are what should be returned: -name = <name of audit> -on_failure = 1 -on_failure_desc = SHUTDOWN SERVER INSTANCE -**********************************/ -SELECT name, on_failure, on_failure_desc -FROM sys.server_audits -SRG-APP-000103-DB-000050<GroupDescription></GroupDescription>SQL2-00-012600SQL Server itself, or the logging or alerting mechanism the application utilizes, must provide a warning when allocated audit record storage volume reaches an organization-defined percentage of maximum audit record storage capacity.<VulnDiscussion>It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Audit processing failures include: software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. - -If audit log capacity were to be exceeded, then events subsequently occurring will not be recorded. Organizations shall define a maximum allowable percentage of storage capacity serving as an alarming threshold (e.g., application has exceeded 80% of log storage capacity allocated) at which time the application or the logging mechanism the application utilizes will provide a warning to the appropriate personnel. - -A failure of database auditing will result in either the database continuing to function without auditing, or in a complete halt to database operations. When audit processing fails, appropriate personnel must be alerted immediately to avoid further downtime or unaudited transactions. This can be an alert provided by a log repository or the OS when a designated log directory is nearing capacity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000143From File Server Resource Manager: Choose the From Server Selection, Select a server from the server pool, and select the server from the lower menu. Expand the File and Storage Services Role. Then Expand the File and iSCSI Services subtree. Select File Server Resource Manager. Click Add Features. Return to Add Roles and Features Wizard. Click Next. On the Features Tab, Click Next. Click Install to install and enable the FSRM.msc Microsoft Management Console Snap-in tool. -From a Command Prompt, open fsrm.msc. Enable File and Folder Quota Management. -Create Quotas for previously identified Audit storage locations based on organizationally defined requirements. - -Right click the appropriate quota or quotas, and click Edit Quota Properties. From the Notification thresholds pane, create a Notification threshold for this Quota utilizing a generate email alert, or a generated Event Log entry.Since SQL Server does not support the monitoring of the available audit log file space, utilize Windows File Server Resource Manager or a third-party application to perform this activity. - -From a Command Prompt, open fsrm.msc. -If fsrm.msc is not installed, the File Server Resource Manager is not installed, File and Folder Quota Management is not enabled. If File Server Resource Manager or a third-party tool capable of sending alert notifications based on audit log store requirements is not installed, this is a finding. - -If fsrm.msc is installed, expand File Server Resource Manager in the left pane. -Expand Quota Management. -Select Quotas. -If Quotas have not been created for defined Audit Log storage locations that meet organizationally defined requirements, this is a finding. - -In the center pane, select each quota to determine its Path, Limit, Type, and Description. - -Right click the appropriate quota or quotas, and click Edit Quota Properties. -Examine the Notification thresholds panel. If there are no Notification thresholds applied to this Quota, this is a finding. -If a Notification Threshold is applied, and it does not send an email alert, or provide an Event Log entry which is handled by an automated Log Alert reporting application, this is a finding. - -If a third-party application is utilized to fulfill this requirement, and it is not configured to provide a notification, this is a finding.SRG-APP-000071-DB-000047<GroupDescription></GroupDescription>SQL2-00-010500SQL Server auditing configuration maximum number of files must be configured to reduce the likelihood of storage capacity being exceeded, while meeting organization-defined auditing requirements.<VulnDiscussion>Configure SQL Server during the installation and/or configuration process to determine if adequate storage capacity has been allocated for audit logs. - -If SQL Server audit logs that are being generated exceed the amount of space reserved for those logs, the system may shutdown or take other measures to stop processing in order to protect transactions from continuing unlogged. - -After the initial setup of SQL Server audit log configuration, it is best to check the available space frequently until the maximum number of files has been reached. Checking the available space can help determine the balance of online audit data with space required.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000138Configure the maximum number of audit log files that are to be generated, staying within the number of logs the system was sized to support. - -Update the max_files parameter of the audits to ensure the correct number of files is defined.Check the SQL Server audit setting on the maximum number of files of the trace used for the auditing requirement. - -Select * from sys.traces. Determine the audit being used to fulfill the overall auditing requirement. Examine the max_files and max_size parameters. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost. - - -The amount of space determined for logging by SQL Server is calculated by multiplying the maximum number of files by the maximum file size. -If auditing will outgrow the space reserved for logging before being overwritten, this is a finding.SRG-APP-000071-DB-000047<GroupDescription></GroupDescription>SQL2-00-010400SQL Server auditing configuration maximum file size must be configured to reduce the likelihood of storage capacity being exceeded, while meeting organization-defined auditing requirements.<VulnDiscussion>Configure SQL Server during the installation and/or configuration process to determine if adequate storage capacity has been allocated for audit logs. - -If SQL Server audit logs that are being generated exceed the amount of space reserved for those logs, the system may shutdown or take other measures to stop processing in order to protect transactions from continuing unlogged. - -After the initial setup of SQL Server audit log configuration, it is best to check the available space until the maximum number of files has been reached. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost. Therefore, the combination of max_size and max_files must be monitored to ensure that overwriting does not occur. This must also coincide with the backup process of off-loading the files.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000138Configure the maximum file size of each audit log file that is to be generated, staying within the file size the system was sized to support. Modify the audit in question to be placed on drives with adequate space or reconfigure to ensure the audit will not fill the space allocated.Check the SQL Server audit setting on the maximum file size of the trace used for the auditing requirement. - -Select * from sys.traces. Determine the audit being used to fulfill the overall auditing requirement. Examine the max_files and max_size parameters. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost. - - -The amount of space determined for logging by SQL Server is calculated by multiplying the maximum number of files by the maximum file size. -If auditing will outgrow the space reserved for logging before being overwritten, this is a finding.SRG-APP-000072-DB-000046<GroupDescription></GroupDescription>SQL2-00-010600SQL Server must have allocated audit record storage capacity to meet the organization-defined requirements for saving audit record information.<VulnDiscussion>SQL Server does not have the ability to be cognizant of potential audit log storage capacity issues. During the installation and/or configuration process, SQL Server should detect and determine if adequate storage capacity has been allocated for audit logs. - -During the installation process, a notification may be provided to the installer indicating, based on the auditing configuration chosen and the amount of storage space allocated for audit logs, the amount of storage capacity available is not sufficient to meet storage requirements. SQL Server is not able to send out notice based on adequate storage capacity allocated for the audit logs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000137Use File Server Resource Manager (FSRM.msc) to enable File and Folder Quota Management and create quotas for identified Audit storage locations.From a Command Prompt, open fsrm.msc. -If fsrm.msc is not installed, the File Server Resource Manager is not installed; File and Folder Quota Management is not enabled. If File Server Resource Manager or a third-party tool capable of sending alert notifications based on audit log store requirements is not installed, this is a finding. - -If fsrm.msc is installed, expand File Server Resource Manager in the left pane. -Expand Quota Management. -Expand Quotas. -If Quotas have not been created for defined Audit Log storage locations, this is a finding.SRG-APP-000101-DB-000044<GroupDescription></GroupDescription>SQL2-00-012400SQL Server must include organization-defined additional, more detailed information in the audit records for audit events identified by type, location, or subject.<VulnDiscussion>SQL Server auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. - -SQL Server does have a means available to add organizationally defined additional, more detailed information in the audit event records. These events may be identified by type, location, or subject. An example of more detailed information the organization may require in audit records could be the name of the application where the request is coming from. - -Some organizations may determine that more detailed information is required for specific database event types. If this information is not available, it could negatively impact forensic investigations into user actions or other malicious events.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000135Create a trace that meets all auditing requirements. - -The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.Check to see that all required events are being audited. -From the query prompt: - SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); -All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. - -Determine the trace(s) being used for the auditing requirement. -In the following, replace # with a trace ID being used for the auditing requirements. -From the query prompt: - SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); -The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, - 170, 171, 172, 173, 175, 176, 177, 178. -If any of the audit event IDs required above is not listed, this is a finding. - -Notes: -1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. -2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. -3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) -Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; -5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. -6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.SRG-APP-000100-DB-000201<GroupDescription></GroupDescription>SQL2-00-012300SQL Server must produce audit records containing sufficient information to establish the identity of any user/subject associated with the event.<VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. - -Database software is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly who performed a given action. If user identification information is not recorded and stored with the audit record, the record itself is of very limited use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001487Create a trace that meets all auditing requirements. - -The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.Check to see that all required events are being audited. -From the query prompt: - SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); -All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. - -Determine the trace(s) being used for the auditing requirement. -In the following, replace # with a trace ID being used for the auditing requirements. -From the query prompt: - SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); -The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, - 170, 171, 172, 173, 175, 176, 177, 178. -If any of the audit event IDs required above is not listed, this is a finding. - -Notes: -1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. -2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. -3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) -Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; -5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. -6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.SRG-APP-000099-DB-000043<GroupDescription></GroupDescription>SQL2-00-012200SQL Server must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.<VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. - -SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know the outcome of attempted actions. This requires specific information regarding the outcome of the action or event that the audit record is referring to. If outcome status information is not recorded and stored with the audit record, the record itself is of very limited use. - -Success and failure indicators ascertain the outcome of a particular event. As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Without knowing the outcome of audit events, it is very difficult to accurately recreate the series of events during forensic analysis. - -If auditing is enabled, SQL Server does capture the outcome status-specific information in all audit records.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000134Create a trace that meets all auditing requirements. - -The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.Check to see that all required events are being audited. -From the query prompt: - SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); -All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. - -Determine the trace(s) being used for the auditing requirement. -In the following, replace # with a trace ID being used for the auditing requirements. -From the query prompt: - SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); -The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, - 170, 171, 172, 173, 175, 176, 177, 178. -If any of the audit event IDs required above is not listed, this is a finding. - -Notes: -1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. -2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. -3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) -Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; -5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. -6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.SRG-APP-000098-DB-000042<GroupDescription></GroupDescription>SQL2-00-012100SQL Server must produce audit records containing sufficient information to establish the sources (origins) of the events.<VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. - -SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly who performed what actions. This requires specific information regarding the source of the event an audit record is referring to. If the source of the event information is not recorded and stored with the audit record, the record itself is of very limited use. - -The source of the event can be a user account and sometimes a system account when timed jobs are run. Without information establishing the source of activity, the value of audit records from a forensics perspective is questionable. If auditing is enabled, SQL Server does capture the source of the event-specific information in all audit records.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000133Create a trace that meets all auditing requirements. - -The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.Check to see that all required events are being audited. -From the query prompt: - SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); -All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. - -Determine the trace(s) being used for the auditing requirement. -In the following, replace # with a trace ID being used for the auditing requirements. -From the query prompt: - SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); -The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, - 170, 171, 172, 173, 175, 176, 177, 178. -If any of the audit event IDs required above is not listed, this is a finding. - -Notes: -1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. -2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. -3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) -Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; -5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. -6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.SRG-APP-000097-DB-000041<GroupDescription></GroupDescription>SQL2-00-012000SQL Server must produce audit records containing sufficient information to establish where the events occurred.<VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. - -SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly where actions were performed. This requires specific information regarding the event location an audit record is referring to. If event location information is not recorded and stored with the audit record, the record itself is of very limited use. - -An event location can be a database instance, table, column, row, etc. Without sufficient information establishing where the audit events occurred, investigation into the cause of events is severely hindered. If auditing is enabled, SQL Server does capture the event location-specific information in all audit records.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000132Create a trace that meets all auditing requirements. - -The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.Check to see that all required events are being audited. -From the query prompt: - SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); -All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. - -Determine the trace(s) being used for the auditing requirement. -In the following, replace # with a trace ID being used for the auditing requirements. -From the query prompt: - SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); -The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, - 170, 171, 172, 173, 175, 176, 177, 178. -If any of the audit event IDs required above is not listed, this is a finding. - -Notes: -1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. -2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. -3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) -Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; -5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. -6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.SRG-APP-000096-DB-000040<GroupDescription></GroupDescription>SQL2-00-011900SQL Server must produce audit records containing sufficient information to establish when (date and time) the events occurred.<VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. - -SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly when actions were performed. This requires specific information regarding the date and time an audit record is referring to. If date and time information is not recorded and stored with the audit record, the record itself is of very limited use. - -If auditing is enabled, SQL Server does capture the date and time-specific information in all audit records.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000131Create a trace that meets all auditing requirements. - -The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.Check to see that all required events are being audited. -From the query prompt: - SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); -All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. - -Determine the trace(s) being used for the auditing requirement. -In the following, replace # with a trace ID being used for the auditing requirements. -From the query prompt: - SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); -The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, - 170, 171, 172, 173, 175, 176, 177, 178. -If any of the audit event IDs required above is not listed, this is a finding. - -Notes: -1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. -2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. -3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) -Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; -5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. -6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.SRG-APP-000095-DB-000039<GroupDescription></GroupDescription>SQL2-00-011800SQL Server must produce audit records containing sufficient information to establish what type of events occurred.<VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. - -SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly what actions were performed. This requires specific information regarding the event type an audit record is referring to. If event type information is not recorded and stored with the audit record, the record itself is of very limited use. - -If auditing is enabled, SQL Server does capture the event type-specific information in all audit records.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000130Create a trace that meets all auditing requirements. - -The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.Check to see that all required events are being audited. -From the query prompt: - SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); -All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. - -Determine the trace(s) being used for the auditing requirement. -In the following, replace # with a trace ID being used for the auditing requirements. -From the query prompt: - SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); -The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, - 170, 171, 172, 173, 175, 176, 177, 178. -If any of the audit event IDs required above is not listed, this is a finding. - -Notes: -1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. -2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. -3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) -Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; -5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. -6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.SRG-APP-000080-DB-000063<GroupDescription></GroupDescription>SQL2-00-023700SQL Server must protect against an individual using a shared account from falsely denying having performed a particular action.<VulnDiscussion>Non-repudiation of actions taken is required in order to maintain application integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. - -Non-repudiation protects individuals against later claims by an author of not having authored a particular document, a sender of not having transmitted a message, a receiver of not having received a message, or a signatory of not having signed a document. - -Use of shared accounts does not provide individual accountability for actions taken on the DBMS or data. Whenever a single database account is used to connect to the database, a secondary authentication method that provides individual accountability is required. This scenario most frequently occurs when an externally hosted application authenticates individual users to the application and the application uses a single account to retrieve or update database information on behalf of the individual users (as in connection pooling). - -When shared accounts are utilized without another means of identifying individual users, users may deny having performed a particular action. - -(Shared accounts should not be confused with Windows groups, which are used in role-based access control.)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000166Remove user-accessible shared accounts and use individual userids. - -Build/configure applications to ensure successful individual authentication prior to shared account access. - -Ensure each user's identity is received and used in audit data in all relevant circumstances. - -Design, develop, and implement a method to log use of any account to which more than one person has access. Restrict interactive access to shared accounts to the fewest persons possible.Obtain the list of authorized SQL Server accounts in the system documentation. - -If accounts are determined to be shared, determine if individuals are first individually authenticated. If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. (The key is individual accountability. If this can be traced, this is not a finding.) - -If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding. - -Review contents of audit logs, traces and data tables to confirm that the identity of the individual user performing the action is captured. If shared identifiers are found, and not accompanied by individual identifiers, this is a finding. - -Note: Privileged installation accounts may be required to be accessed by the DBA or other administrators for system maintenance. In these cases, each use of the account must be logged in some manner to assign accountability for any actions taken during the use of the account.SRG-APP-000091-DB-000066<GroupDescription></GroupDescription>SQL2-00-011400SQL Server must generate audit records for the DoD-selected list of auditable events.<VulnDiscussion>Audit records can be generated from various components within the information system, such as network interfaces, hard disks, modems, etc. From an application perspective, certain specific application functionalities may be audited, as well. - -The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records (i.e., auditable events, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked). - -Organizations may define the organizational personnel accountable for determining which application components shall provide auditable events. - -Auditing provides accountability for changes made to the SQL Server configuration or its objects and data. It provides a means to discover suspicious activity and unauthorized changes. Without auditing, a compromise may go undetected and without a means to determine accountability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000172Create a trace that meets all auditing requirements. - -The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.Check to see that all required events are being audited. -From the query prompt: - SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); -All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. - -Determine the trace(s) being used for the auditing requirement. -In the following, replace # with a trace ID being used for the auditing requirements. -From the query prompt: - SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); -The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, - 170, 171, 172, 173, 175, 176, 177, 178. -If any of the audit event IDs required above is not listed, this is a finding. - -Notes: -1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. -2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. -3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) -Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; -5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. -6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.SRG-APP-999999-DB-000209<GroupDescription></GroupDescription>SQL2-00-023600SQL Server must be configured to use Windows Integrated Security.<VulnDiscussion>SQL Server Authentication does not provide for many of the authentication requirements of the DoD. In some cases workarounds are present, but the authentication is not as robust and does not provide needed functionality. Without that functionality, SQL Server is vulnerable to authentication attacks. Consideration must be given to the placement of SQL server inside a forest to ensure evaluation of risk within the environment is considered. Risk includes introduction of risk to SQL Server from other applications or workstations as well as risk from introduction of SQL server itself into an established environment. - -There may be situations where SQL Server Authentication must remain enabled, because of constraints imposed by a third-party application. In such a case, document the constraint in the system security plan, and obtain signed approval.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000366From SQL Server Management Studio, right-click the server, and then click Properties. - -Select the Security page. Under Server authentication, select Windows Authentication Mode, and then click OK.To determine the Server Authentication Mode, execute the following: - -EXEC XP_LOGINCONFIG 'login mode' - -If the config_value does not equal "Windows NT Authentication", this is a finding.SRG-APP-000063-DB-000023<GroupDescription></GroupDescription>SQL2-00-010200SQL Server default account sa must have its name changed.<VulnDiscussion>SQL Server's 'sa' account has special privileges required to administer the database. The 'sa' account is a well-known SQL Server account name and is likely to be targeted by attackers, and is thus more prone to providing unauthorized access to the database. - -Since the SQL Server 'sa' is administrative in nature, the compromise of a default account can have catastrophic consequences, including the complete loss of control over SQL Server. Since SQL Server needs for this account to exist and it should not be removed, one way to mitigate this risk is to change the 'sa' account name.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000040Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Logins >> click 'sa' account name. - -Hit <F2> while the name is highlighted in order to edit the name. - -Rename the 'sa' account.Verify the SQL Server default 'sa' account name has been changed. - -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Logins. - -If SQL Server default 'sa' account name is in the 'Logins' list, this is a finding.SRG-APP-000063-DB-000022<GroupDescription></GroupDescription>SQL2-00-010100Use of the SQL Server software installation account must be restricted to SQL Server software installation.<VulnDiscussion>This requirement is intended to limit exposure due to operating from within a privileged account. SQL Server does support the organizational requirement that users of information system accounts with access to an organization-defined list of security functions or security-relevant information use non-privileged accounts and roles, when accessing other (non-security) system functions. - -Use of privileged accounts for non-administrative purposes puts data at risk of unintended or unauthorized loss, modification, or exposure. In particular, DBA accounts if used for non-administration application development or application maintenance can lead to miss-assignment of privileges where privileges are inherited by object owners. It may also lead to loss or compromise of application data where the elevated privileges bypass controls designed in, and provided by, applications. - -The SQL Server installation account requires privileges not required for SQL Server administration or other functions. Use of accounts configured with excess privileges may result in the loss or compromise of data or system settings due to elevated privileges that bypass controls designed to protect them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000040Restrict usage of the SQL Server installation account to SQL Server installation, upgrade, and maintenance actions only. - -Disable installation accounts when authorized actions are not being performed.Review system documentation to identify the installation account. Verify whether the account is used for anything beyond SQL Server software installation, upgrade, and maintenance actions. - -If the account is used for anything beyond SQL Server installation, upgrade, and maintenance actions, this is a finding.SRG-APP-000063-DB-000021<GroupDescription></GroupDescription>SQL2-00-010000DBA OS or domain accounts must be granted only those host system privileges necessary for the administration of SQL Server.<VulnDiscussion>SQL Server DBAs, if assigned excessive OS privileges, could perform actions that could endanger the information system or hide evidence of malicious activity. - -This requirement is intended to limit exposure due to operating from within a privileged account or role. The check and fix are based on the assumption that Role-Based Access Control (RBAC) is in effect, as mandated by other STIG requirements. They further assume that, as mandated elsewhere, the privileged accounts discussed here are distinct from the accounts used by the same people when not performing privileged functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000040 -Remove any unnecessary privileges and any unauthorized members from the Group(s) representing DBAs. - -Remove any unnecessary Group memberships from the user accounts representing DBAs.From the system security documentation, obtain the list of SQL Server DBA accounts, the OS/domain Group(s) representing those DBAs' job role(s), and the OS permissions required by that/those role(s). - - -To review local accounts and groups: - -Log on to the Windows server hosting SQL Server, using an account with administrator privileges. - -From a command prompt opened as administrator, type gpedit.msc, and press [ENTER]. In Group Policy Editor, navigate to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment. Scan the list to determine which privileges are assigned to the Group(s) representing the SQL Server DBA job role(s). If any privileges are assigned that are not required by these roles, this is a finding. - -From the command prompt, type lusrmgr.msc, and press [ENTER]. In the Local Users and Groups console, navigate to Users. Right-click each DBA user. Click Properties. Click the 'Member of' tab. If any parent groups are listed that are not specific to DBA roles, this is a finding. - -In the Local Users and Groups console, navigate to Groups. Right-click each DBA Group. Click Properties. Review the list of group members. If any account that does not represent a DBA is listed, this is a finding. - - -To review domain-level accounts and groups: - -Log on to a domain controller with the necessary privileges. - -Open Active Directory Users and Computers (available from menus or run dsa.msc) - -Determine the location of the accounts or groups to be reviewed. The default is the Users container, but they could have been created or moved to an Organizational Unit (OU) that is domain specific. - -Right-click each DBA user. Click Properties. Click the 'Member of' tab. If any parent groups are listed that are not specific to DBA roles, this is a finding. - -Right-click each DBA Group. Click Properties. Select the 'Members' tab. Review the list of group members. If any account that does not represent a DBA is listed, this is a finding.SRG-APP-000063-DB-000020<GroupDescription></GroupDescription>SQL2-00-009900OS and domain accounts utilized to run external procedures called by SQL Server must have limited privileges.<VulnDiscussion>This requirement is intended to limit exposure due to operating from within a privileged account or role. The inclusion of role is intended to address those situations where an access control policy, such as Role-Based Access Control (RBAC), is being implemented and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account. - -To limit exposure when operating from within a privileged account or role, the application must support organizational requirements that users of information system accounts, or roles, with access to an organization-defined list of security functions or security-relevant information, use non-privileged accounts, or roles, when accessing other (non-security) system functions. - -Use of privileged accounts for non-administrative purposes puts data at risk of unintended or unauthorized loss, modification, or exposure. In particular, DBA accounts, if used for non-administration application development or application maintenance, can lead to misassignment of privileges where privileges are inherited by object owners. It may also lead to loss or compromise of application data where the elevated privileges bypass controls designed in, and provided by, applications. - -External applications called by SQL Server may be executed under OS or domain accounts with unnecessary privileges. This can lead to unauthorized access to OS resources and compromise of the OS, SQL Server, or any other services provided by the host platform.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000040Limit privileges to SQL Server-related OS and domain accounts to those required privileges needed to perform their SQL Server-specific functionality.Determine which OS or domain accounts are used by SQL Server to run external procedures. Validate that these accounts have only the privileges necessary to perform the required functionality. - -If any OS or domain accounts utilized by SQL Server are running external procedures and have privileges beyond those required for running the external procedures, this is a finding.SRG-APP-000063-DB-000019<GroupDescription></GroupDescription>SQL2-00-009800SQL Server DBA roles must not be assigned excessive or unauthorized privileges.<VulnDiscussion>This requirement is intended to limit exposure due to operating from within a privileged account or role. The inclusion of role is intended to address those situations where an access control policy, such as Role-Based Access Control (RBAC), is being implemented and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account. - -Audit of privileged activity may require physical separation, employing information systems on which the user does not have privileged access. - -To limit exposure and provide forensic history of activity when operating from within a privileged account or role, SQL Server does support organizational requirements that users of information system accounts, or roles, with access to an organization-defined list of security functions or security-relevant information, use non-privileged accounts, or roles, when accessing other (non-security) system functions. - -SQL Server provides access logging that ensures users who are granted a privileged role (or roles) have their privileged activity logged. DBAs, if assigned excessive privileges, could perform actions that endanger the information system or hide evidence of malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000040Remove permissions from DBAs and other administrative users beyond those required for administrative functions. - -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Logins >> right click <'administrator account name'> >> Properties >> User >> Securables. - -Remove 'Securables' permissions from DBAs and other administrative users that are beyond what is required. - -Navigate from 'Securables' to 'Server Roles'. - -Remove 'Server Roles' permissions from DBAs and other administrative users that are beyond what is required. - -Navigate from 'Server Roles' to 'Users mapped to the login'. - -Remove 'Users mapped to the login' permissions from DBAs and other administrative users that are beyond what is required.Obtain the list of all DBAs. -Obtain documented role assignments for each DBA. -Obtain from system documentation or use SQL Server to determine privilege assignment of user-defined roles. - -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Logins >> right click <'administrator account name'> >> Properties >> User >> Securables. - -If any item in the 'Permission' listing, for each highlighted item that exists in the 'Securables' listing, has excessive privileges, this is a finding. - -Navigate from 'Securables' to 'Server Roles'. - -If any checked 'Server roles' are determined to be excessive privileges, this is a finding. - -Navigate from 'Server Roles' to 'Users mapped to the login'. - -If any checked 'Database role membership' of each highlighted and checked 'Database' are determined to be excessive privileges, this is a finding.SRG-APP-000063-DB-000018<GroupDescription></GroupDescription>SQL2-00-009700All use of privileged accounts must be audited.<VulnDiscussion>This is intended to limit exposure, by making it possible to trace any unauthorized access to other data or functionality by a privileged user account or role that has permissions on security functions or security-relevant information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000040Create a trace that meets all auditing requirements. - -The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.Check to see that all required events are being audited. -From the query prompt: - -SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); - -All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. - -Determine the trace(s) being used for the auditing requirement. -In the following, replace # with a trace ID being used for the auditing requirements. -From the query prompt: - -SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); -The following required event IDs should be listed: -14, 15, 18, 20, -102, 103, 104, 105, 106, 107, 108, 109, 110, -111, 112, 113, 115, 116, 117, 118, -128, 129, 130, -131, 132, 133, 134, 135, -152, 153, -170, 171, 172, 173, 175, 176, 177, 178. - -If any of the audit event IDs required above is not listed, this is a finding. - -Notes: -1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. -2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. -3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) -Use the following query to obtain a list of all event IDs, and their meaning: -SELECT * FROM sys.trace_events; -5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. -6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.SRG-APP-000063-DB-000017<GroupDescription></GroupDescription>SQL2-00-009600Administrators must utilize a separate, distinct administrative account when performing administrative activities, accessing database security functions, or accessing security-relevant information within SQL Server.<VulnDiscussion>This requirement is intended to limit exposure due to operating from within a privileged account or role. The inclusion of role is intended to address those situations where an access control policy, such as Role-Based Access Control (RBAC), is being implemented and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account. - -To limit exposure when operating from within a privileged account or role, SQL Server does support organizational requirements that users of information system accounts, or roles, with access to an organization-defined list of security functions or security-relevant information, use non-privileged accounts, or roles, when accessing other (non-security) system functions. - -When privileged activities are not separated from non-privileged activities, SQL Server could be subject to unauthorized changes of settings or data, which a standard user would not normally have access to outside of an authorized maintenance session. Often, administrator accounts have a unique prefix to help with identification. These accounts are located within SQL Server and may only provide access to one database instance or a limited number of database objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000040Remove DBA privileges and privileges to administer owned objects that are assigned to the administrator's non-DBA account. -Remove the permission access from the account that has direct access by running the following script: -USE master -REVOKE <'server privilege name'> TO <'account name'> -GO - -Remove the user account from the role's Member list where the account is not authorized for specified permission by running the following script: -USE master -ALTER SERVER ROLE [<'server role name'>] DROP MEMBER <'user name'> -GO - -Provide administrators with separate accounts for administration and regular accounts for non-administrator activity.Obtain a list of SQL Server DBAs or other administrative accounts. Run the following SQL script to check all users’ permissions: - -SELECT SP1.[name] AS 'Login', 'Role: ' + SP2.[name] COLLATE DATABASE_DEFAULT AS 'ServerPermission' -FROM sys.server_principals SP1 - JOIN sys.server_role_members SRM - ON SP1.principal_id = SRM.member_principal_id - JOIN sys.server_principals SP2 - ON SRM.role_principal_id = SP2.principal_id -UNION ALL -SELECT SP.[name] AS 'Login' , SPerm.state_desc + ' ' + SPerm.permission_name COLLATE DATABASE_DEFAULT AS 'ServerPermission' - FROM sys.server_principals SP - JOIN sys.server_permissions SPerm - ON SP.principal_id = SPerm.grantee_principal_id -ORDER BY [Login], [ServerPermission] - -If any DBA or administrative objects are owned by non-DBA or non-administrative accounts, this is a finding. - -If any DBA or administrator has authorization for non- administrative access to the system for which they are the administrator and they do not have a non-administrator account, this is a finding.SRG-APP-000062-DB-000016<GroupDescription></GroupDescription>SQL2-00-009400SQL Server must restrict access to system tables, other configuration information, and metadata to DBAs and other authorized users.<VulnDiscussion>The principle of Least Privilege must be applied to the ability of users to access system tables, system management information, other configuration information, and metadata. Unauthorized access to this data could result in unauthorized changes to database objects, access controls, or SQL Server configuration. Only database administrators and other authorized users must be allowed such access. - -To aid in tracking and administering such permissions, individual logins must not be directly granted permissions or built-in server roles. Instead, user-defined server roles must be created, with the permissions and built-in server roles granted to them; the individual logins must be assigned to the appropriate user-defined server roles. - -The built-in server role "sysadmin" is a partial exception. This cannot be granted to a user-defined role, only to a login account. Most (not necessarily all) database administrators will need to be members of sysadmin. Without this, most DBCC commands and the system stored procedures/functions listed below are unavailable. The users who require such access must be documented and approved. - -In addition, if the site uses backup-restore software that connects to SQL Server via the Virtual Device Interface (VDI), the account used by that software must have the sysadmin role. (See Microsoft Knowledge Base article 2926557, http://support.microsoft.com/kb/2926557). If this applies, it must be documented and approved. - -Stored procedures/functions available only to the sysadmin role: -fn_yukonsecuritymodelrequired -sp_add_agent_parameter -sp_add_agent_profile -sp_adddatatype -sp_adddistributiondb -sp_adddistributor -sp_addqreader_agent -sp_addsubscriber -sp_addsubscriber_schedule -sp_addtabletocontents -sp_attachsubscription -sp_cdc_cleanup_change_table -sp_cdc_disable_db -sp_cdc_disable_table -sp_cdc_drop_job -sp_cdc_enable_db -sp_cdc_enable_table -sp_cdc_restoredb -sp_cdc_vupgrade -sp_certify_removable -sp_change_agent_parameter -sp_change_agent_profile -sp_change_subscription_properties -sp_change_users_login -sp_changedistpublisher -sp_changedistributiondb -sp_changedistributor_password -sp_changedistributor_property -sp_changemergesubscription -sp_changeqreader_agent -sp_changereplicationserverpasswords -sp_changesubscriptiondtsinfo -sp_checkinvalidivarticle -sp_copysubscription -sp_create_removable -sp_cycle_errorlog -sp_dbcmptlevel -sp_dbmmonitoraddmonitoring -sp_dbmmonitorchangealert -sp_dbmmonitordropalert -sp_dbmmonitordropmonitoring -sp_dbmmonitorhelpalert -sp_dbmmonitorhelpmonitoring -sp_dbmmonitorresults -sp_dbmmonitorupdate -sp_dbremove -sp_drop_agent_parameter -sp_drop_agent_profile -sp_dropdatatypemapping -sp_dropdistpublisher -sp_dropdistributiondb -sp_dropdistributor -sp_dropmergepullsubscription -sp_droppullsubscription -sp_dropsubscriber -sp_dsninfo -sp_enumdsn -sp_flush_commit_table_on_demand -sp_generate_agent_parameter -sp_get_distributor -sp_get_Oracle_publisher_metadata -sp_getagentparameterlist -sp_getdefaultdatatypemapping -sp_grant_publication_access -sp_help_agent_default -sp_help_agent_parameter -sp_help_agent_profile -sp_helpdistpublisher -sp_helpdistributor -sp_helpmergesubscription -sp_helpqreader_agent -sp_helpreplicationdboption -sp_identitycolumnforreplication -sp_IHValidateRowFilter -sp_IHXactSetJob -sp_link_publication -sp_monitor -sp_MSadd_distribution_agent -sp_MSadd_logreader_agent -sp_MSadd_merge_agent -sp_MSadd_snapshot_agent -sp_MSadd_subscriber_schedule -sp_MSadd_tracer_history -sp_MSadd_tracer_token -sp_MScdc_cleanup_job -sp_MScdc_db_ddl_event -sp_MScdc_ddl_event -sp_MSchange_distribution_agent_properties -sp_MSchange_logreader_agent_properties -sp_MSchange_merge_agent_properties -sp_MSchange_snapshot_agent_properties -sp_MSchangedynamicsnapshotjobatdistributor -sp_MSchangedynsnaplocationatdistributor -sp_MScheck_pull_access -sp_MScleanupmergepublisher_internal -sp_MSclear_dynamic_snapshot_location -sp_MScreate_dist_tables -sp_MSdbuserpriv -sp_MSdeletefoldercontents -sp_MSdrop_6x_replication_agent -sp_MSdrop_merge_agent -sp_MSdrop_snapshot_dirs -sp_MSdropmergedynamicsnapshotjob -sp_MSdynamicsnapshotjobexistsatdistributor -sp_MSenumallpublications -sp_MSfetchAdjustidentityrange -sp_MSfix_6x_tasks -sp_MSforce_drop_distribution_jobs -sp_MSget_agent_names -sp_MSget_jobstate -sp_MSget_oledbinfo -sp_MSget_publication_from_taskname -sp_MSgetdbversion -sp_MSgetmaxsnapshottimestamp -sp_MShelp_repl_agent -sp_MShelp_replication_status -sp_MShelp_snapshot_agent -sp_MShelpconflictpublications -sp_MShelpdynamicsnapshotjobatdistributor -sp_MShelplogreader_agent -sp_MShelpsnapshot_agent -sp_MShelptranconflictcounts -sp_MSinit_publication_access -sp_MSreinit_failed_subscriptions -sp_MSremoveoffloadparameter -sp_MSrepl_backup_complete -sp_MSrepl_backup_start -sp_MSrepl_createdatatypemappings -sp_MSrepl_dropdatatypemappings -sp_MSrepl_enumarticlecolumninfo -sp_MSrepl_enumpublications -sp_MSrepl_enumpublishertables -sp_MSrepl_enumsubscriptions -sp_MSrepl_enumtablecolumninfo -sp_MSrepl_getdistributorinfo -sp_MSrepl_startup_internal -sp_MSreplagentjobexists -sp_MSreplcheck_permission -sp_MSreplcheck_pull -sp_MSreplcheck_subscribe -sp_MSreplcheck_subscribe_withddladmin -sp_MSreplcopyscriptfile -sp_MSreplremoveuncdir -sp_MSsetalertinfo -sp_MSSetServerProperties -sp_MSsetupnosyncsubwithlsnatdist -sp_MSsetupnosyncsubwithlsnatdist_cleanup -sp_MSsetupnosyncsubwithlsnatdist_helper -sp_MSstartdistribution_agent -sp_MSstartmerge_agent -sp_MSstartsnapshot_agent -sp_MSstopdistribution_agent -sp_MSstopmerge_agent -sp_MSstopsnapshot_agent -sp_MSupdate_agenttype_default -sp_oledbinfo -sp_procoption -sp_removedbreplication -sp_removesrvreplication -sp_replication_agent_checkup -sp_replicationdboption -sp_resetstatus -sp_restoredbreplication -sp_SetAutoSAPasswordAndDisable -sp_setdefaultdatatypemapping -sp_updatestats -sp_validatelogins -sp_vupgrade_mergeobjects -sp_vupgrade_replication -sp_vupgrade_replsecurity_metadata -xp_repl_convert_encrypt_sysadmin_wrapper -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000037If necessary memberships in the sysadmin role are not documented or not approved, document them and obtain approval. - -If unnecessary memberships in the sysadmin role are documented, remove them from the documentation. - -Remove all direct access permissions and unauthorized permissions as required using the below instructions: - -In SQL Server Management Studio, Object Explorer, expand <SQL Server instance> >> Security >> Logins >> Right-click <user account name> >> Properties >> User >> Securables. - -Remove Securables permissions from user account. - -Navigate from Securables to Server Roles. - -Remove Server Roles permissions from user account. - -Navigate from Server Roles to Users Mapping. - -Remove direct permissions on db_accessadmin, db_backupoperator, db_datareader, db_datawriter, db_ddladmin, db_denydatareader, db_denydatawriter, db_owner, and db_securityadmin from user account.Use SQL Server and system documentation to determine privilege assignment of user-defined roles. - -Determine which user-defined roles grant privileges to system tables and configuration data stored in SQL Server. - -For each Login: - -In SQL Server Management Studio, Object Explorer, expand <SQL Server instance> >> Security >> Logins >> Right-click <login account name> >> Properties >> User >> Securables. - -If any item in the Explicit Permissions listing, for each highlighted item that exists in the Securables listing, indicates direct permission access, and that permission is anything other than Connect SQL, this is a finding. - -Navigate from Securables to Server Roles. - -If any Server Roles are checked from the following list, indicating direct permission access, this is a finding: -bulkadmin -dbcreator -diskadmin -processadmin -securityadmin -serveradmin -setupadmin - -If the sysadmin server role is checked, review system documentation to determine whether this login's need for the sysadmin role is documented and approved. If it is not, this is a finding. - -If any user-defined server roles with system table or configuration data privileges are checked, review system documentation to determine whether this login's need for the role is documented and approved. If it is not, this is a finding. - -Navigate from Server Roles to User Mapping. Select in turn each entry where the User column is non-blank. If any Database Roles are checked from the following list, indicating direct permission access, this is a finding: -db_accessadmin -db_backupoperator -db_datareader -db_datawriter -db_ddladmin -db_denydatareader -db_denydatawriter -db_owner -db_securityadminSRG-APP-000062-DB-000012<GroupDescription></GroupDescription>SQL2-00-009100A single SQL Server database connection configuration file (or a single set of credentials) must not be used to configure all database clients.<VulnDiscussion>Applications employ the concept of least privilege for specific duties and information systems (including specific functions, ports, protocols, and services). The concept of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of information systems. - -Many sites distribute a single SQL Server connection configuration file to all site database users that contains network access information for all databases on the site. Such a file provides information to access SQL Server databases not required by all users that may assist in unauthorized access attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000037Implement procedures to supply SQL Server database connection information to only those databases authorized for the user.Check procedures for providing SQL Server database connection information to users/applications. If procedures do not indicate or implement restrictions to connections required by the particular user/application which indicate process of least privilege and specific authorization was employed, this is a finding.SRG-APP-000062-DB-000011<GroupDescription></GroupDescription>SQL2-00-009000SQL Server must restrict access to sensitive information to authorized user roles.<VulnDiscussion>Applications employ the concept of least privilege for specific duties and information systems (including specific functions, ports, protocols, and services). The concept of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of information systems. - -Unauthorized access to sensitive data may compromise the confidentiality of personnel privacy, threaten national security or compromise a variety of other sensitive operations. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000037Add the user-defined server role to the system documentation. - -Add the assigned privileges of the user-defined server role to the system documentation. - -Remove the user from direct access to server permission by running the following script: -USE master -REVOKE <'server permission name'> TO <'account name'> CASCADE - -Remove server role permission from the user-defined server role by running the following script: -USE master -REVOKE <'server role name'> TO [<'server role name'>] - -Rename the user-defined role by running the following script: -USE master -ALTER SERVER ROLE [<'old role name'>] WITH NAME = [<'new role name'>]Obtain the list of available user-defined server roles from system documentation. - -Obtain the list of available user-defined server roles from the SQL Server system by running the following script: -/********************************************************************************** - LIST ALL INDIRECT (via ROLES) ACCESS TO THE SERVER PERMISSION. - ***********************************************************************************/ -DECLARE @admin_Account_name sysname -SET @admin_Account_name = 'NO admin ACCOUNT found' -DECLARE @server_name sysname -SET @server_name = 'NO Server found' - -SELECT @server_name = name FROM sys.servers - WHERE server_id = 0 -SET @admin_Account_name = @server_name + '\Administrator' - -SELECT pe.grantee_principal_id - , pr.type AS 'Grantee_Type' - , pr.name AS 'Grantee_Name' - , pe.type - , pe.permission_name - , pe.state - , pe.state_desc - FROM sys.server_permissions pe - JOIN sys.server_principals pr - ON pe.grantee_principal_id = pr.principal_id - JOIN sys.server_principals ps - ON pe.grantor_principal_id = ps.principal_id - LEFT JOIN sys.server_principals us - ON us.principal_id = pe.major_id - WHERE pr.type IN ('R') - AND pe.grantee_principal_id > 10 - AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', - 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', - 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') - AND NOT pr.name = @admin_Account_name - ORDER BY CASE pe.state - WHEN 'D' THEN 1 - WHEN 'W' THEN 2 - WHEN 'G' THEN 3 - ELSE 4 - END - -If any listed user-defined roles are not found in the system documentation, this is a finding. - -Obtain the list assigned privileges for all user-defined roles in the system documentation. - -Check all SQL Server user-defined server roles for access rights as it relates to the separation of duties. Repeat steps for each user-defined server role. -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Server Roles >> right click <'user-defined server role name'> >> Properties >> General >> Securables. If any user-defined role is assigned privileges that are not documented in the system documentation, this is a finding. - -If any user-defined role contains permissions that are inconsistent with separation sensitive information assignment, this is a finding. - -If system access requires more than one level of sensitive information access and the user-defined role names do not clearly differentiate between the different levels of sensitive information, this is a finding.SRG-APP-000062-DB-000010<GroupDescription></GroupDescription>SQL2-00-008900SQL Server processes or services must run under custom, dedicated OS or domain accounts.<VulnDiscussion>Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action. - -The concept of separation of duties extends to processes. The DBMS must run under a custom, dedicated OS or domain account. When the DBMS is running under a shared account, users with access to that account could inadvertently or maliciously make changes to the DBMS’s settings, files, or permissions. Similarly, related services must run under dedicated accounts where this is possible. The SQL Server Browser and Writer services are exceptions: see http://msdn.microsoft.com/en-us/library/hh510203(v=sql.110).aspx and http://msdn.microsoft.com/en-us/library/ms175536(v=sql.110).aspx.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000037Configure the SQL Server services to use a custom, dedicated OS or domain account.Check OS settings to determine whether SQL Server processes are running under a dedicated OS or domain account. If the SQL Server processes are running under shared accounts, this is a finding. - -From a Command Prompt, type services.msc, and press [ENTER]. Scroll down to the SQL Server Services. SQL Server Services begin with SQL. The following services, when present, should be listed as follows: - -Service Name: Log On As: -SQL Full-text Filter Daemon Launcher: NT Service\UNIQUE CUSTOM ACCOUNT -SQL Server [stand-alone]: NT Service\UNIQUE CUSTOM ACCOUNT -SQL Server [cluster]: <domain>\<CustomServiceAccount> -SQL Server Agent: NT Service\UNIQUE CUSTOM ACCOUNT -SQL Server Analysis Services: NT Service\UNIQUE CUSTOM ACCOUNT -SQL Server Browser: Local Service -SQL Server Distributed Replay Client: NT Service\UNIQUE CUSTOM ACCOUNT -SQL Server Distributed Replay Controller: NT Service\UNIQUE CUSTOM ACCOUNT -SQL Server Integration Services 11.0: NT Service\UNIQUE CUSTOM ACCOUNT -SQL Server Reporting Services: NT Service\UNIQUE CUSTOM ACCOUNT -SQL Server VSS Writer: Local System - -UNIQUE CUSTOM ACCOUNT refers to an account with which no other service listed in the services.msc window is assigned. If any account requiring a unique custom account uses an account that any other service utilizes (regardless of service status), this is a finding.SRG-APP-000062-DB-000009<GroupDescription></GroupDescription>SQL2-00-008800SQL Server must enforce separation of duties through assigned information access authorizations.<VulnDiscussion>Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action. - -Additionally, the person or entity accountable for monitoring the activity must be separate as well. To meet this requirement, applications, when applicable, shall be divided where functionality is based on roles and duties. Examples of separation of duties include: (i) mission functions and distinct information system support functions are divided among different individuals/roles; (ii) different individuals perform information system support functions (e.g., system management, systems programming, configuration management, quality assurance and testing, network security); (iii) security personnel who administer access control functions do not administer audit functions; and (iv) different administrator accounts for different roles. - -Privileges granted outside the role of the application user job function are more likely to go unmanaged or without oversight for authorization. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000037Add the user-defined server role to the system documentation. - -Add the assigned privileges of the user-defined server role to the system documentation. - -Remove the user from direct access to server permission by running the following script: -USE master -REVOKE <'server permission name'> TO <'account name'> CASCADE - -Remove server role permission from the user-defined server role by running the following script: -USE master -REVOKE <'server role name'> TO [<'server role name'>]Check for direct user assignment to server permissions by running the following script: -/********************************************************************************** - LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT - SYSTEM ADMINISTRATOR accounts. DO NOT LIST ROLES. -***********************************************************************************/ -DECLARE @admin_Account_name sysname -SET @admin_Account_name = 'NO administrator account found' -DECLARE @server_name sysname -SET @server_name = 'NO Server found' - -SELECT @server_name = name FROM sys.servers - WHERE server_id = 0 -SET @admin_Account_name = @server_name + '\Administrator' - -SELECT pe.grantee_principal_id - , pr.type AS 'Grantee_Type' - , pr.name AS 'Grantee_Name' - , pe.type - , pe.permission_name - , pe.state - , pe.state_desc - FROM sys.server_permissions pe - JOIN sys.server_principals pr - ON pe.grantee_principal_id = pr.principal_id - JOIN sys.server_principals ps - ON pe.grantor_principal_id = ps.principal_id - LEFT JOIN sys.server_principals us - ON us.principal_id = pe.major_id - WHERE pr.type IN ('K', 'S', 'U') - AND pe.grantee_principal_id > 10 - AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', - 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', - 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') - AND NOT pr.name = @admin_Account_name - AND NOT pe.permission_name = 'connect sql' - ORDER BY CASE pr.type - WHEN 'K' THEN 1 - WHEN 'S' THEN 2 - WHEN 'U' THEN 3 - ELSE 4 - END - -If any user account list indicates direct access to any server permission, this is a finding. - -Obtain the list of available user-defined server roles from system documentation. - -Obtain the list of available user-defined server roles from the SQL Server system by running the following script: -/********************************************************************************** - LIST ALL INDIRECT (via ROLES) ACCESS TO THE SERVER PERMISSION. - ***********************************************************************************/ -DECLARE @admin_Account_name sysname -SET @admin_Account_name = 'NO admin ACCOUNT found' -DECLARE @server_name sysname -SET @server_name = 'NO Server found' - -SELECT @server_name = name FROM sys.servers - WHERE server_id = 0 -SET @admin_Account_name = @server_name + '\Administrator' - -SELECT pe.grantee_principal_id - , pr.type AS 'Grantee_Type' - , pr.name AS 'Grantee_Name' - , pe.type - , pe.permission_name - , pe.state - , pe.state_desc - FROM sys.server_permissions pe - JOIN sys.server_principals pr - ON pe.grantee_principal_id = pr.principal_id - JOIN sys.server_principals ps - ON pe.grantor_principal_id = ps.principal_id - LEFT JOIN sys.server_principals us - ON us.principal_id = pe.major_id - WHERE pr.type IN ('R') - AND pe.grantee_principal_id > 10 - AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', - 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', - 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') - AND NOT pr.name = @admin_Account_name - AND NOT pe.permission_name = 'connect sql' - ORDER BY CASE pe.state - WHEN 'D' THEN 1 - WHEN 'W' THEN 2 - WHEN 'G' THEN 3 - ELSE 4 - END - -If any listed user-defined roles are not found in the system documentation, this is a finding. - -Obtain the list of assigned privileges for all user-defined roles in the system documentation. - -Check all SQL Server user-defined server roles for access rights as it relates to the separation of duties. Repeat steps for each user-defined server role. -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Server Roles >> right click <'user-defined server role name'> >> Properties >> General >> Securables. If any roles are found that do not enforce separation of duties, this is a finding.SRG-APP-000085-DB-000038<GroupDescription></GroupDescription>SQL2-00-011000SQL Server utilizing Discretionary Access Control (DAC) must enforce a policy that limits propagation of access rights.<VulnDiscussion>Discretionary Access Control (DAC) is based on the premise that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). - -These DAC concepts extend to the server level. Server instances have the potential for the access controls to propagate without limit, resulting in unauthorized access. - -The DBMS must ensure the recipient of server permissions possesses only the access intended. The DBMS must enforce the ability to limit unauthorized rights propagation. If propagation is not prevented, users can continue to grant rights to other users without limit.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001693Document and obtain approval for each GRANT_WITH_GRANT_OPTION that is required. - -Correct each unapproved GRANT_WITH_GRANT_OPTION with REVOKE and GRANT statements of the form (replacing "ALTER ANY DATABASE" with the actual server permission at issue): - -REVOKE ALTER ANY DATABASE FROM SampleLoginOrServerRole CASCADE; -GRANT ALTER ANY DATABASE TO SampleServerRole; -- Note, no WITH GRANT OPTION clause here.Check for rights propagation assignment to DBMS server permissions by running the following query: - -USE master; -SELECT * -FROM sys.server_permissions -WHERE state_desc = 'GRANT_WITH_GRANT_OPTION'; - -If any of the permissions listed have not been documented and approved as requiring GRANT_WITH_GRANT_OPTION, this is a finding.SRG-APP-000036-DB-000174<GroupDescription></GroupDescription>SQL2-00-008500SQL Server must enforce DAC policy allowing users to specify and control sharing by named individuals, groups of individuals, or by both; limiting propagation of access rights; and including or excluding access to the granularity of a single user.<VulnDiscussion>Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) are employed by organizations to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, domains). - -DAC is a type of access control methodology serving as a means of restricting access to objects and data based on the identity of subjects and/or groups to which they belong. It is discretionary in the sense that application users with the appropriate permissions to access an application resource or data have the discretion to pass that permission on to another user either directly or indirectly. - -Data protection requirements may result in a DAC policy being specified as part of the application design. Discretionary access controls would be employed at the application level to restrict and control access to application objects and data, thereby providing increased information security for the organization. - -When DAC controls are employed, those controls must limit sharing to named application users, groups of users, or both. The application DAC controls must also limit the propagation of access rights and have the ability to exclude access to data down to the granularity of a single user. - -Databases using DAC must have the ability for the owner of an object or information to assign or revoke rights to view or modify the object or information. If the owner of an object or information does not have rights to exclude access to an object or information at a user level, users may gain access to objects and information they are not authorized to view/modify.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001362Add the user-defined server role to the system documentation. - -Add the user as a member of the user-defined server role within the system documentation. - -Remove the user from direct access to server permission by running the following script: -USE master -REVOKE <'server permission name'> TO <'account name'> CASCADE - -Remove the user from user-defined role access by running the following script: -USE master -ALTER SERVER ROLE [<'server role name'>] DROP MEMBER <'user name'> - -Add the user-defined role access to the user by running the following script: -USE master -ALTER SERVER ROLE [<'server role name'>] ADD MEMBER <'user name'>Check for direct user assignment to server permissions by running the following script: -/********************************************************************************** - LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT - SYSTEM ADMINISTRATOR accounts. DO NOT LIST ROLES. -***********************************************************************************/ -DECLARE @admin_Account_name sysname -SET @admin_Account_name = 'NO Administrator account found' -DECLARE @server_name sysname -SET @server_name = 'NO Server found' - -SELECT @server_name = name FROM sys.servers - WHERE server_id = 0 -SET @admin_Account_name = @server_name + '\Administrator' - -SELECT pe.grantee_principal_id - , pr.type AS 'Grantee_Type' - , pr.name AS 'Grantee_Name' - , pe.type - , pe.permission_name - , pe.state - , pe.state_desc - FROM sys.server_permissions pe - JOIN sys.server_principals pr - ON pe.grantee_principal_id = pr.principal_id - JOIN sys.server_principals ps - ON pe.grantor_principal_id = ps.principal_id - LEFT JOIN sys.server_principals us - ON us.principal_id = pe.major_id - WHERE pr.type IN ('K', 'S', 'U') - AND pe.grantee_principal_id > 10 - AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', - 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', - 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') - AND NOT pr.name = @admin_Account_name - ORDER BY CASE pr.type - WHEN 'K' THEN 1 - WHEN 'S' THEN 2 - WHEN 'U' THEN 3 - ELSE 4 - END - -If any user account list indicates direct access to any server permission, this is a finding. - -Obtain the list of available user-defined server roles from system documentation. - -Obtain the list of available user-defined server roles from the SQL Server system by running the following script: -/********************************************************************************** - LIST ALL INDIRECT (via ROLES) ACCESS TO THE SERVER PERMISSION. - ***********************************************************************************/ -DECLARE @admin_Account_name sysname -SET @admin_Account_name = 'NO admin ACCOUNT found' -DECLARE @server_name sysname -SET @server_name = 'NO Server found' - -SELECT @server_name = name FROM sys.servers - WHERE server_id = 0 -SET @admin_Account_name = @server_name + '\Administrator' - -SELECT pe.grantee_principal_id - , pr.type AS 'Grantee_Type' - , pr.name AS 'Grantee_Name' - , pe.type - , pe.permission_name - , pe.state - , pe.state_desc - FROM sys.server_permissions pe - JOIN sys.server_principals pr - ON pe.grantee_principal_id = pr.principal_id - JOIN sys.server_principals ps - ON pe.grantor_principal_id = ps.principal_id - LEFT JOIN sys.server_principals us - ON us.principal_id = pe.major_id - WHERE pr.type IN ('R') - AND pe.grantee_principal_id > 10 - AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', - 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', - 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') - AND NOT pr.name = @admin_Account_name - ORDER BY CASE pe.state - WHEN 'D' THEN 1 - WHEN 'W' THEN 2 - WHEN 'G' THEN 3 - ELSE 4 - END - -If any listed user-defined roles are not found in the system documentation, this is a finding. - -Obtain the list of user role assignments in the system documentation. - -Check all SQL Server user-defined server roles for authorized and documented permission assignments. Repeat steps for each user-defined server role. -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Server Roles >> right click <'user-defined server role name'> >> Properties >> Members. If any roles are found that are not authorized and documented, this is a finding.SRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-008400SQL Server must enforce access control policies to restrict the Unsafe assembly permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Unsafe assembly' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'Unsafe assembly' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Unsafe assembly' permission access from the role that is not authorized by executing the following query: - - -REVOKE Unsafe assembly TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Unsafe assembly' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Unsafe assembly' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges to the 'Unsafe assembly' permission and the role is not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-008300SQL Server must not grant users direct access to the Alter any endpoint permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Alter any endpoint' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts. If administrative user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any endpoint' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE ALTER ANY ENDPOINT TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Alter any endpoint' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any endpoint' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Alter any endpoint' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-008200SQL Server must not grant users direct access to the Alter any database permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Alter any database' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any database' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE ALTER ANY DATABASE TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Alter any database' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any database' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Alter any database' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-008100SQL Server must not grant users direct access to the Alter Any Credential permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Alter any credential' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any credential' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE ALTER ANY CREDENTIAL TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Alter any credential' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any credential' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Alter any credential' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-008000SQL Server must not grant users direct access to the Alter any connection permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Alter any connection' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any connection' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE ALTER ANY CONNECTION TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Alter any connection' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any connection' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Alter any connection' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-007900SQL Server must not grant users direct access control to the Alter Any Availability Group permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Alter any availability group' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts. If administrative user accounts have direct access to administrative roles, this access must be removed. - -(The SQL Server installer gives this privilege to the system account "NT AUTHORITY\SYSTEM", so this account is excluded from the Check. See article KB2847723 in the Microsoft knowledge base.) - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter Any Availability Group' permission access from the account that has direct access by using the following code. Substitute the relevant names for the text in angle brackets. - --- For each login identified in the Check: -USE master; -REVOKE ALTER ANY AVAILABILITY GROUP FROM <login name>; -GO - --- If the necessary server role does not already exist, --- and any user identified in the Check needs this permission: -USE master; -CREATE SERVER ROLE <role name> AUTHORIZATION <appropriate principal name>; -GO -GRANT ALTER ANY AVAILABILITY GROUP TO <role name>; -GO - --- For each user identified in the Check who needs this permission: -USE master; -ALTER SERVER ROLE <role name> ADD MEMBER <login name>; -GOObtain the list of accounts that have direct access to the server-level permission 'Alter any availability group' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any availability group' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Alter any availability group' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-007800SQL Server must not grant users direct access to the Alter server state permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Alter server state' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter server state' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE ALTER SERVER STATE TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Alter server state' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter server state' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Alter server state' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-007600SQL Server must not grant users direct access to the Alter any event notification permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Alter any event notification' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any event notification' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE ALTER ANY EVENT NOTIFICATION TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Alter any event notification' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any event notification' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Alter any event notification' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-007500SQL Server must enforce access control policies to restrict the View any database permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'View any database' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'View any database' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the "View any database" permission access from the role that is not authorized by executing the following query: - -REVOKE View any database TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'View any database' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'View any database' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-007400SQL Server must not grant users direct access to the Alter any server audit permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Alter any server audit' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any server audit' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE ALTER ANY SERVER AUDIT TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Alter any server audit' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any server audit' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Alter any server audit' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-007300SQL Server must enforce access control policies to restrict the Shutdown permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Shutdown' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. , If the 'Shutdown' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the' 'Shutdown' permission access from the role that is not authorized by executing the following query: - - -REVOKE Shutdown TO <'role name'>Obtain the list of roles that are authorized for the 'Shutdown' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Shutdown' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-007200SQL Server must enforce access control policies to restrict the External access assembly permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'External access assembly' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'External access assembly' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'External access assembly' permission access from the role that is not authorized by executing the following query: - - -REVOKE External access assembly TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'External access assembly' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'External access assembly' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-007100SQL Server must enforce access control policies to restrict the Create trace event notification permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Create trace event notification' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'Create trace event notification' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Create trace event notification' permission access from the role that is not authorized by executing the following query: - - -REVOKE Create trace event notification TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Create trace event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Create trace event notification' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-007000SQL Server must enforce access control policies to restrict the Create server role permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Create server role' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. , If the 'Create server role' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Create server role' permission access from the role that is not authorized by executing the following query: - - -REVOKE Create server role TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Create server role' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Create server role' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-006900SQL Server must enforce access control policies to restrict the Create endpoint permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Create endpoint' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'Create endpoint' permissions are granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Create endpoint' permission access from the role that is not authorized by executing the following query: - - -REVOKE Create endpoint TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Create endpoint' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. - -Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Create endpoint' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-006800SQL Server must enforce access control policies to restrict the Create DDL event notification permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Create DDL event notification' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'Create DDL event notification' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Create DDL event notification' permission access from the role that is not authorized by executing the following query: - - -REVOKE Create DDL event notification TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Create DDL event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Create DDL event notification' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-006700SQL Server must enforce access control policies to restrict the Create availability group permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Create availability group' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'Create availability group' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Create availability group' permission access from the role that is not authorized by executing the following query: - - -REVOKE Create availability group TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Create availability group' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Create availability group' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-006600SQL Server must enforce access control policies to restrict the Alter any server audit permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any server audit' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any server audit' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any server audit' permission access from the role that is not authorized by executing the following query: - - -REVOKE Alter any server audit TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Alter any server audit' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any server audit' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.SRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-006500SQL Server must enforce access control policies to restrict the View any definition permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'View any definition' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'View any definition' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'View any definition' permission access from the role that is not authorized by executing the following query: - - -REVOKE View any definition TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'View any definition' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'View any definition' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-006400SQL Server must not grant users direct access to the Authenticate server permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Authenticate Server' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Authenticate Server' permission access from the account that has direct access by running the following script: - -USE master; -REVOKE AUTHENTICATE SERVER FROM <account name>; -GOObtain the list of accounts that have direct access to the server-level permission 'Authenticate Server' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'AUTHENTICATE SERVER' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Authenticate Server' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-006300SQL Server must not grant users direct access to the Administer bulk operations permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Administer bulk operations' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Administer bulk operations' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE ADMINISTER BULK OPERATIONS TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Administer bulk operations' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Administer bulk operations' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Administer bulk operations' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-006200SQL Server must not grant users direct access to the Create endpoint permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Create endpoint' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Create endpoint' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE CREATE ENDPOINT TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Create endpoint' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Create endpoint' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Create endpoint' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-006100SQL Server must not grant users direct access to the Create DDL event notification permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Create DDL event notification' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Create DDL event notification' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE CREATE DDL EVENT NOTIFICATION TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Create DDL Event Notification' by running the following query: - -SELECT -who.name AS [Principal Name], -who.type_desc AS [Principal Type], -who.is_disabled AS [Principal Is Disabled], -what.state_desc AS [Permission State], -what.permission_name AS [Permission Name] -FROM -sys.server_permissions what -INNER JOIN sys.server_principals who -ON who.principal_id = what.grantee_principal_id -WHERE -what.permission_name = 'Create DDL Event Notification' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY -who.name -; -GO - -If any user accounts have direct access to the 'Create DDL Event Notification' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-006000SQL Server must not grant users direct access to the Create availability group permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Create availability group' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes. -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Create availability group' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE CREATE AVAILABILITY GROUP TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Create availability group' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Create availability group' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Create availability group' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-005900SQL Server must not grant users direct access to the Create any database permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Create any database' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Create any database'" permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE CREATE ANY DATABASE TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Create any database' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Create any database' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Create any database' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-005800SQL Server must not grant users direct access to the Control server permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Control server' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Control server' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE CONTROL SERVER TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Control server' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Control server' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Control server' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-005700SQL Server must enforce access control policies to restrict the Administer bulk operations permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Administer bulk operations' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'Administer bulk operations' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Administer bulk operations' permission access from the role that is not authorized by executing the following query: - - -REVOKE Administer bulk operations TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Administer bulk operations' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. - -Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Administer bulk operations' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-005600SQL Server must enforce access control policies to restrict the Alter resources permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter resources' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'Alter resources' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter resources' permission access from the role that is not authorized by executing the following query: - - -REVOKE Alter resources TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Alter resources' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter resources' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-005500SQL Server must not grant users direct access to the Alter any linked server permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Alter any linked server' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any linked server' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE ALTER ANY LINKED SERVER TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Alter any linked server' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any linked server' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Alter any linked server' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-005300SQL Server must not grant users direct control to the Alter any event session permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Alter any event session' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any event session' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE ALTER ANY EVENT SESSION TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Alter any event session' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any event session' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Alter any event session' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-005200SQL Server must not grant users direct access to the Alter trace permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Alter trace' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter trace' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE ALTER TRACE TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Alter trace' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter trace' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Alter trace' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-005100SQL Server must not grant users direct access to the Alter Settings permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Alter Settings' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter Settings' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE ALTER SETTINGS TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Alter Settings' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter Settings' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Alter Settings' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-005000SQL Server must not grant users direct access to the Create trace event notification permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Create trace event notification' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Create trace event notification' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE CREATE TRACE EVENT NOTIFICATION TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Create trace event notification' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Create trace event notification' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Create trace event notification' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-004900SQL Server must not grant users direct access to the Alter resources permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Alter resources' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter resources' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE ALTER RESOURCES TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Alter resources' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter resources' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Alter resources' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-004800SQL Server must not grant users direct access to the External access assembly permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'External access assembly' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'External access assembly' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE EXTERNAL ACCESS ASSEMBLY TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'External access assembly' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'External access assembly' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'External access assembly' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-004700SQL Server must not grant users direct access to the Alter any login permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Alter any login' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any login' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE ALTER ANY LOGIN TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Alter any login' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any login' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Alter any login' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-004600SQL Server must enforce access control policies to restrict the Alter any availability group permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any availability group' permission is a high server-level privilege that must only be granted to individual administration accounts through roles and users. If the 'Alter any availability group' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any availability group' permission access from the role that is not authorized by executing the following query: - - -REVOKE Alter any availability group TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Alter any availability group' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any availability group' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-004500SQL Server must enforce access control policies to restrict the Alter any login permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any login' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any login' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any login' permission access from the role that is not authorized by executing the following query: - - -REVOKE Alter any login TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Alter any login' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any login' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-004300SQL Server must enforce access control policies to restrict the Alter any linked server permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any linked server' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any linked server' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any linked server' permission access from the role that is not authorized by executing the following query: - - -REVOKE Alter any linked server TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Alter any linked server' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any linked server' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-004200SQL Server must not grant users direct access control to the Shutdown permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Shutdown' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts. If administrative user accounts have direct access to administrative roles, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Shutdown' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE SHUTDOWN TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Shutdown' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Shutdown' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY -who.name -; -GO - -If any user accounts have direct access to the 'Shutdown' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-004100SQL Server must enforce access control policies to restrict the View server state permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'View server state' permission is a high server-level privilege that must only granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'View server state' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'View server state' permission access from the role that is not authorized by executing the following query: - - -REVOKE View server state TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'View server state' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'View server state' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-004000SQL Server must enforce access control policies to restrict the Alter trace permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter trace' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'Alter trace' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter trace' permission access from the role that is not authorized by executing the following query: - - -REVOKE Alter trace TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Alter trace' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter trace' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-003900SQL Server must not grant users direct access to the Unsafe assembly permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Unsafe assembly' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Unsafe assembly' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE UNSAFE ASSEMBLY TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Unsafe assembly' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Unsafe assembly' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Unsafe assembly' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-003800SQL Server must enforce access control policies to restrict the Control server permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Control server' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'Control server' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Control server' permission access from the role that is not authorized by executing the following query: - - -REVOKE Control server TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Control server' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Control server' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-003700SQL Server must not grant users direct access to the Create server role permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Create server role' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Create server role' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE CREATE SERVER ROLE TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Create server role' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Create server role' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Create server role' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-003600SQL Server must enforce access control policies to restrict the Alter any server role permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any server role' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any server role' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any server role' permission access from the role that is not authorized by executing the following query: - - -REVOKE Alter any server role TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Alter any server role' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any server role' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-003500SQL Server must enforce access control policies to restrict the Alter Settings permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter Settings' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'Alter Settings' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter Settings' permission access from the role that is not authorized by executing the following query: - - -REVOKE Alter Settings TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Alter Settings' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter Settings' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-003400SQL Server must enforce access control policies to restrict the Authenticate server permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Authenticate server' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Authenticate server' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Authenticate server' permission access from the role that is not authorized by executing the following query: - - -REVOKE Authenticate server TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Authenticate server' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Authenticate server' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-003300SQL Server must enforce access control policies to restrict the Create any database permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Create any database' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'Create any database' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Create any database' permission access from the role that is not authorized by executing the following query: - - -REVOKE Create any database TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Create any database' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Create any database' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-003200SQL Server must not grant users direct access to the View server state permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'View server state' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Document any necessary exceptions, and obtain the appropriate approval. - -Remove the 'View server state' permission access from an account that has direct access by running the following script: - -USE master; -REVOKE VIEW SERVER STATE TO <'account name'>; -GOObtain the list of accounts that have direct access to the server-level permission 'View server state' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'View server state' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user account has direct access to the 'View server state' permission, and the need for this has not been documented and approved, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-003100SQL Server must not grant users direct access to the Alter any server role permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'Alter any server role' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any server role' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE ALTER ANY SERVER ROLE TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'Alter any server role' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any server role' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'Alter any server role' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-003000SQL Server must not grant users direct access to the View any definition permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'View any definition' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'View any definition' permission access from the account that has direct access by running the following script: - - -USE master - -REVOKE VIEW ANY DEFINITION TO <'account name'> - -GOObtain the list of accounts that have direct access to the server-level permission 'View any definition' by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'View any definition' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any user accounts have direct access to the 'View any definition' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-002900SQL Server must enforce access control policies to restrict the Alter any connection permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any connection' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any connection' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any connection' permission access from the role that is not authorized by executing the following query: - - -REVOKE Alter any connection TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Alter any connection' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any connection' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.SRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-002800SQL Server must enforce access control policies to restrict the Alter any credential permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any credential' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any credential' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any credential' permission access from the role that is not authorized by executing the following query: - - -REVOKE Alter any credential TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Alter any credential' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any credential' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.SRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-002700SQL Server must enforce access control policies to restrict the Alter any database permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any database' permission is a high server-level privilege that must only be granted to individual administration accounts through roles If the 'Alter any database' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any database' permission access from the role that is not authorized by executing the following query: - - -REVOKE Alter any database TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Alter any database' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any database' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.SRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-002600SQL Server must enforce access control policies to restrict the Alter any endpoint permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any endpoint' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any endpoint' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any endpoint' permission access from the role that is not authorized by executing the following query: - - -REVOKE Alter any endpoint TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Alter any endpoint' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any endpoint' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.SRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-002400SQL Server must enforce access control policies to restrict the Alter any event session permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any event session' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any event session' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any event session' permission access from the role that is not authorized by executing the following query: - - -REVOKE Alter any event session TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Alter any event session' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any event session' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.SRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-002300SQL Server must enforce access control policies to restrict Alter server state permissions to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter server state' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'Alter server state' permissions are granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter server state' permission access from the role that is not authorized by executing the following query: - - -REVOKE Alter server state TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Alter server state' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. - -Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter server state' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding.SRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-002200SQL Server must enforce non-DAC policies over users and resources where the policy rule set for each policy specifies access control information (i.e., position, nationality, age, project, time of day).<VulnDiscussion>Non-DAC controls are determined by policy makers and are managed centrally or by a central authority. These controls must not be changed at the discretion of ordinary application users. Data protection requirements may result in a non-DAC policy being specified as part of the application design. Non-DACs are employed at the application level to restrict and control access to application data, thereby providing increased information security for the organization. - -SQL Server Non-DAC is maintained through the use of Roles. Roles are set up within SQL Server to grant user accounts read and/or write permissions to system objects: databases, tables, columns, etc. After a role is created, user accounts can be assigned to a role granting them permissions of that role. - -If users have permissions to database objects that they are not authorized to have, the user account that has access to the unauthorized database object must be removed from the role that grants that access. Policy rule sets would be developed to establish that each user receives only the information to which the user is authorized. - -Frequently, roles grant access to multiple privileges; if a user is authorized and determined to need access to authorized privilege granted by a role, and unauthorized for other privileges of that same role, it may be necessary to split the privileges of one role into two roles.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Add the user as a member of the user-defined server role within the system documentation. - -Remove the user from direct access to server permission by running the following script: -USE master -REVOKE <'server permission name'> TO <'account name'> CASCADE - -Remove the user from user-defined role access by running the following script: -USE master -ALTER SERVER ROLE [<'server role name'>] DROP MEMBER <'user name'>Check for direct user assignment to server permissions by running the following script: -/********************************************************************************** -LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT -SYSTEM ADMINISTRATOR ACCOUNTS. DO NOT LIST ROLES. -***********************************************************************************/ -DECLARE @admin_Account_name sysname -SET @admin_Account_name = 'NO administrator account found' -DECLARE @server_name sysname -SET @server_name = 'NO Server found' - -SELECT @server_name = name FROM sys.servers -WHERE server_id = 0 -SET @admin_Account_name = @server_name + '\Administrator' - -SELECT pe.grantee_principal_id -, pr.type AS 'Grantee_Type' -, pr.name AS 'Grantee_Name' -, pe.type -, pe.permission_name -, pe.state -, pe.state_desc -FROM sys.server_permissions pe -JOIN sys.server_principals pr -ON pe.grantee_principal_id = pr.principal_id -JOIN sys.server_principals ps -ON pe.grantor_principal_id = ps.principal_id -LEFT JOIN sys.server_principals us -ON us.principal_id = pe.major_id -WHERE pr.type IN ('K', 'S', 'U') -AND pe.grantee_principal_id > 10 -AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', -'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', -'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') -AND NOT pr.name = @admin_Account_name -AND NOT pe.permission_name = 'connect sql' -ORDER BY CASE pr.type -WHEN 'K' THEN 1 -WHEN 'S' THEN 2 -WHEN 'U' THEN 3 -ELSE 4 -END; -GO - -If any user account listed indicates direct access to any server permission, this is a finding. - -Obtain the list of available user-defined server roles from system documentation. - -Obtain the list of available user-defined server roles from the SQL Server system by running the following script: -/********************************************************************************** - LIST ALL INDIRECT (via ROLES) ACCESS TO THE SERVER PERMISSION. - ***********************************************************************************/ -DECLARE @admin_Account_name sysname -SET @admin_Account_name = 'NO admin ACCOUNT found' -DECLARE @server_name sysname -SET @server_name = 'NO Server found' - -SELECT @server_name = name FROM sys.servers -WHERE server_id = 0 -SET @admin_Account_name = @server_name + '\Administrator' - -SELECT pe.grantee_principal_id -, pr.type AS 'Grantee_Type' -, pr.name AS 'Grantee_Name' -, pe.type -, pe.permission_name -, pe.state -, pe.state_desc -FROM sys.server_permissions pe -JOIN sys.server_principals pr -ON pe.grantee_principal_id = pr.principal_id -JOIN sys.server_principals ps -ON pe.grantor_principal_id = ps.principal_id -LEFT JOIN sys.server_principals us -ON us.principal_id = pe.major_id -WHERE pr.type IN ('R') -AND pe.grantee_principal_id > 10 -AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', -'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', -'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') -AND NOT pr.name = @admin_Account_name -AND NOT pe.permission_name = 'connect sql' -ORDER BY CASE pe.state -WHEN 'D' THEN 1 -WHEN 'W' THEN 2 -WHEN 'G' THEN 3 -ELSE 4 -END; -GO - -Obtain the list of user role assignments in the system documentation. - -Check all SQL Server user-defined server roles for authorized and documented permission assignments. Repeat steps for each user-defined server role. -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Server Roles >> right click <'user-defined server role name'> >> Properties >> Members. - -If both user-defined role(s) and user(s) are listed as "Member of this role", this is a propagation of access rights, and this is a finding.SRG-APP-000292-DB-000138<GroupDescription></GroupDescription>SQL2-00-023300SQL Server must notify appropriate individuals when accounts are modified.<VulnDiscussion>Once an attacker establishes initial access to a system, they often attempt to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to modify an existing account for later use. - -Notification of account creation is one method and best practice for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the creation of application user accounts and notifies administrators and/or application owners exist. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes. - -To address the multitude of policy based access requirements, many application developers choose to integrate their applications with enterprise level authentication/access mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001684Create a trace that meets all auditing requirements. - -The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.Check to see that all required events are being audited. -From the query prompt: - SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); -All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. - -Determine the trace(s) being used for the auditing requirement. -In the following, replace # with a trace ID being used for the auditing requirements. -From the query prompt: - SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); -The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, - 170, 171, 172, 173, 175, 176, 177, 178. -If any of the audit event IDs required above is not listed, this is a finding. - -Notes: -1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. -2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. -3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) -Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; -5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. -6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.SRG-APP-000027-DB-000186<GroupDescription></GroupDescription>SQL2-00-001900SQL Server must automatically audit account modification.<VulnDiscussion>Once an attacker establishes initial access to a system, they often attempt to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply modify an existing account. - -Auditing of account modification is one method and best practice for mitigating this risk. A comprehensive application account management process ensures an audit trail automatically documents the modification of application user accounts and, as required, notifies administrators, application owners, and/or appropriate individuals. Applications must provide this capability directly, leverage complimentary technology providing this capability, or a combination thereof. - -Automated account-auditing processes greatly reduce the risk that accounts will be surreptitiously modified, and provides logging that can be used for forensic purposes. - -To address the multitude of policy based access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access mechanisms meeting or exceeding access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001403Create a trace that meets all auditing requirements. - -The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.Check to see that all required events are being audited. -From the query prompt: - SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); -All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. - -Determine the trace(s) being used for the auditing requirement. -In the following, replace # with a trace ID being used for the auditing requirements. -From the query prompt: - SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); -The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, - 170, 171, 172, 173, 175, 176, 177, 178. -If any of the audit event IDs required above is not listed, this is a finding. - -Notes: -1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. -2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. -3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) -Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; -5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. -6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.SRG-APP-000019-DB-000197<GroupDescription></GroupDescription>SQL2-00-001600SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited.<VulnDiscussion>Remote access is any access to an organizational information system by a user (or an information system) communicating through an external, non-organization-controlled network (e.g., the Internet). Examples of remote access methods include dial-up, broadband, and wireless. - -Remote network and system access is accomplished by leveraging common communication protocols to establish a remote connection. These connections will typically originate over either the public Internet or the Public Switched Telephone Network (PSTN). Neither of these internetworking mechanisms is private or secure, and they do not by default restrict access to networked resources once connectivity is established. - -Numerous best practices are employed to protect remote connections, such as utilizing encryption to protect data sessions and firewalls to restrict and control network connectivity. In addition to these protections, auditing must also be utilized in order to track system activity, assist in diagnosing system issues, and provide evidence needed for forensic investigations post security incident. -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001454Create a trace that meets all auditing requirements. - -The script provided in the supplemental file, Trace.sql, can be used to do this; edit it as necessary to capture any additional, locally defined events.Check to see that all required events are being audited. -From the query prompt: - SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); -All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. - -Determine the trace(s) being used for the auditing requirement. -In the following, replace # with a trace ID being used for the auditing requirements. -From the query prompt: - SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); -The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, - 170, 171, 172, 173, 175, 176, 177, 178. -If any of the audit event IDs required above is not listed, this is a finding. - -Notes: -1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. -2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. -3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) -Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; -5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. -6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding.SRG-APP-000001-DB-000031<GroupDescription></GroupDescription>SQL2-00-000100The number of concurrent SQL Server sessions for each system account must be limited.<VulnDiscussion>A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks. For example, boundary protection devices can filter certain types of packets to protect devices on an organization’s internal network from being directly affected by DoS attacks. - -One way SQL Server can limit exposure to DoS attacks is to restrict the number of connections that can be opened by a single user. SQL Server supports this through the use of logon triggers. (Note, however, that this need not be the only, or even the principal, means for satisfying this requirement. Depending on the architecture and capabilities of the network and application, a network device or an application may be more suitable for providing this protection.) - -When determining the appropriate values for this limit, take the characteristics of the various kinds of user into account, and bear in mind that some applications and some users may need to have multiple sessions open. For example, while a standard account using a simple application may never need more than, say, five connections, a database administrator using SQL Server Management Studio may need significantly more, because each tab in that application counts as a distinct session. - -Architectural note: In SQL Server, a count of active sessions by user can be obtained from one of the dynamic management views. For example: - - SELECT original_login_name, count(*) - FROM sys.dm_exec_sessions - WHERE is_user_process = 1 - GROUP BY original_login_name; - -However, for this to return an accurate count in a logon trigger, the user would have to have the View Server State privilege. (Without this privilege, the trigger sees information only about the current session, so would always return a count of one.) View Server State would give that user access to a wide swath of information about the server, violating SQL2-00-004100. One way to avoid this exposure is to create a summary table, and a view of that table that restricts each user to seeing his/her own count, and establish a frequently-run background job to refresh the table (using the above query or similar). The logon trigger then queries the view to obtain a count that is accurate enough for most purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000054Establish the limit(s) appropriate to the type(s) of user account accessing the SQL Server instance, and record them in the system documentation. - -Implement one or more logon triggers to enforce the limit(s), without exposing the dynamic management views to general users.Review the system documentation to determine whether any limits have been defined. If not, this is a finding. - -If one limit has been defined but is not applied to all users, including privileged administrative accounts, this is a finding. - -If multiple limits have been defined, to accommodate different types of user, verify that together they cover all users. If not, this is a finding. - -If a mechanism other than a logon trigger is used, verify its correct operation by the appropriate means. If it does not work correctly, this is a finding. - -Otherwise, determine if a logon trigger exists: - -EITHER, in SQL Server Management Studio's Object Explorer tree: -Expand [SQL Server Instance] >> Security >> Server Objects >> Triggers - -OR run the query: -SELECT * FROM master.sys.server_triggers; - -If no triggers are listed, this is a finding. - -If triggers are listed, identify the one(s) limiting the number of concurrent sessions per user. If none are found, this is a finding. If they are present but disabled, this is a finding. - -Examine the trigger source code for logical correctness and for compliance with the documented limit(s). If errors or variances exist, this is a finding. - -Verify that the system does execute the trigger(s) each time a user session is established. If it does not operate correctly for all types of user, this is a finding.SRG-APP-000231-DB-000154<GroupDescription></GroupDescription>SQL2-00-024500The Service Master Key must be backed up, stored offline and off-site.<VulnDiscussion>Backup and recovery of the Service Master Key may be critical to the complete recovery of the database. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001199Document and implement procedures to safely back up and store the Service Master Key. Include in the procedures methods to establish evidence of backup and storage, and careful, restricted access and restoration of the Service Master Key. Also, include provisions to store the key off-site. -BACKUP SERVICE MASTER KEY TO FILE = 'path_to_file' -ENCRYPTION BY PASSWORD = 'password'Review procedures for, and evidence of backup of, the SQL Server Service Master Key in the System Security Plan. - -If the procedures or evidence do not exist, this is a finding. - -If the procedures do not indicate offline and off-site storage of the Service Master Key, this is a finding. - -If procedures do not indicate access restrictions to the Service Master Key backup, this is a finding.SRG-APP-999999-DB-000209 <GroupDescription></GroupDescription>SQL2-00-024600Domain accounts used to manage a SQL Server platform must be different from those used to manage other platforms.<VulnDiscussion>Separate accounts used to manage the SQL Server platform help prevent a lateral move within an environment if SQL were to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000366Set up and use separate domain accounts to manage the SQL Server platform. These accounts must be different from those used to manage other platforms.Determine the accounts being used to manage the SQL Server operating system. Determine whether the same accounts are being used to manage other platforms. If the same account is used to manage more than one platform, this is a finding. -Note: If, because of the application configuration, there are multiple instances of SQL that would share a given exploit, a single account would be allowed to be used for the group and would not be considered a finding. -SRG-APP-000196-DB-000301<GroupDescription></GroupDescription>SQL2-00-019601SQL Server databases in the unclassified environment, containing sensitive information, must be encrypted using approved cryptography.<VulnDiscussion>Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data. - -Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. - -Data files that are not encrypted are vulnerable to theft. When data files are not encrypted, they can be copied and opened on a separate system. The data can be compromised without the information owner's knowledge that the theft has even taken place.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001144Configure SQL Server to encrypt sensitive data stored in each database. Use only NIST-certified cryptography to provide encryption.If the system exists in the Classified environment, this is NA. - -For each database under the SQL Server instance, review the system documentation to determine whether the database holds sensitive information. If it does not, this is not a finding. - -If it does handle sensitive information, review the system documentation and configuration to determine whether the sensitive information is protected by NIST-approved cryptography. If not, this is a finding.SRG-APP-000133-DB-000207<GroupDescription></GroupDescription>SQL2-00-025100The OS must limit privileges to the SQL Server Data Root directory and its subordinate directories and files.<VulnDiscussion>Default database file locations should be protected from unauthorized access. The system databases, essential to SQL Server operation, are typically located here.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001499Navigate to the identified folder location(s). Right-click the folder, click Properties. On the Security tab, modify the security permissions so that files and folders have at most the permissions listed below. Right-click each folder under the identified folder(s), click Properties. On the Security tab, modify the security permissions so that at most the following permissions are present. -CREATOR OWNER (Full Control) -System (Full control) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -System Administrators (Full Control) [Note 3] -SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read & Execute) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2, 4] -SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Execute, Write) [Notes 1, 2] - ------ - -Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically-generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control because these permissions are available only to the specific service when it is running and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.110).aspx. - -Note 2: Tips for adding a service SID/virtual account to a folder's permission list. -1) In Windows Explorer, right-click on the folder and select "Properties." -2) Select the "Security" tab -3) Click "Edit" -4) Click "Add" -5) Click "Locations" -6) Select the computer name -7) Search for the name -7.a) SQL Server Service -7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) -7.a.ii) Select the "MSSQL$<instance name>" user and click OK -7.b) SQL Agent Service -7.b.i) Type "NT SERVICE\SQL" and click "Check Names" -7.b.ii) Select the "SQLAgent$<instance name>" user and click OK -8) Click OK -9) Permission like a normal user from here - -Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only. - -Note 4: It may also be necessary to grant the SQL Server Agent permission to Delete the \Log directory and its contents.Obtain the SQL Server default data directory location: from a command prompt, open the registry editor by typing regedit.exe, and pressing [ENTER]. Navigate to the following registry location: -HKEY_LOCAL_MACHINE ->> SOFTWARE ->> Microsoft ->> Microsoft SQL Server ->> [INSTANCE NAME] ->> Setup ->> SqlDataRoot - -In the registry tree, the [INSTANCE NAME] for a SQL Server 2012 database engine instance is normally shown as "MSSQL11" followed by a period and the name that was specified for the SQL Server service at installation time. If multiple SQL Server instances are installed, each will have its own [INSTANCE NAME] node and subtree in the registry. - -The value in the Data column for the SqlDataRootregistry entry is the default file system path for the SQL Server 2012 data files. Navigate to that folder location using a command prompt or Windows Explorer. The following instructions assume that Windows Explorer is used. - -Determine whether a DefaultData registry entry also exists. Repeat the above for the path: -...[INSTANCE NAME] ->> MSSQLServer ->> DefaultData - -Verify that the identified folder(s) and their contents have only authorized privileges. Right-click the folder, click Properties. On the Security tab, verify that at most the following permissions are present: -CREATOR OWNER (Full Control) -System (Full control) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -System Administrators (Full Control) [Note 3] -SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read & Execute) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2, 4] -SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Execute, Write) [Notes 1, 2] -If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - -Right-click each folder, if any, under the above folder(s); click Properties. On the Security tab, verify that at most the permissions listed in the preceding paragraph are present. If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - ------ - -Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically-generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control because these permissions are available only to the specific service when it is running and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.110).aspx. - -Note 2: Tips for adding a service SID/virtual account to a folder's permission list. -1) In Windows Explorer, right-click on the folder and select "Properties." -2) Select the "Security" tab -3) Click "Edit" -4) Click "Add" -5) Click "Locations" -6) Select the computer name -7) Search for the name -7.a) SQL Server Service -7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) -7.a.ii) Select the "MSSQL$<instance name>" user and click OK -7.b) SQL Agent Service -7.b.i) Type "NT SERVICE\SQL" and click "Check Names" -7.b.ii) Select the "SQLAgent$<instance name>" user and click OK -8) Click OK -9) Permission like a normal user from here - -Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only. - -Note 4: It may also be necessary to grant the SQL Server Agent permission to Delete the \Log directory and its contents. This is not a finding.SRG-APP-000133-DB-000207<GroupDescription></GroupDescription>SQL2-00-025200The OS must limit privileges to the SQL Server data directories and their subordinate directories and files.<VulnDiscussion>Database files must be protected from unauthorized access. Although default data locations are created at installation time, sites can, and will, use other directories for site-created database files to comply with best practices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001499Navigate to the identified folder location(s). Right-click the folder, click Properties. On the Security tab, modify the security permissions so that files and folders have at most the permissions listed below. Right-click each folder under the identified folder(s), click Properties. On the Security tab, modify the security permissions so that at most the following permissions are present. -CREATOR OWNER (Full Control) -System (Full control) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read & Execute) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] -SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Write) [Notes 1, 2] -System Administrators (Full Control) [Note 3] - - ------ - -Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically-generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control because these permissions are available only to the specific service when it is running and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.110).aspx. - - -Note 2: Tips for adding a service SID/virtual account to a folder's permission list. -1) In Windows Explorer, right-click on the folder and select "Properties." -2) Select the "Security" tab -3) Click "Edit" -4) Click "Add" -5) Click "Locations" -6) Select the computer name -7) Search for the name -7.a) SQL Server Service -7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) -7.a.ii) Select the "MSSQL$<instance name>" user and click OK -7.b) SQL Agent Service -7.b.i) Type "NT SERVICE\SQL" and click "Check Names" -7.b.ii) Select the "SQLAgent$<instance name>" user and click OK -8) Click OK -9) Permission like a normal user from here - - -Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only.Obtain the SQL Server data directory location(s): in a tool such as SQL Server Management Studio, run the statement: -SELECT DISTINCT -LEFT(physical_name, (LEN(physical_name) - CHARINDEX('\',REVERSE(physical_name)) + 1 )) -AS "Database Data File Paths", -type_desc -FROM sys.master_files -WHERE database_id > 4 -AND type = 0 - -The query result is a list of file systems locations used for databases other than the system databases. Navigate to each of those folder locations using a command prompt or Windows Explorer. The following instructions assume that Windows Explorer is used. - - -Verify that the identified folders and their contents have only authorized privileges. Right-click each folder, click Properties. On the Security tab, verify that at most the following permissions are present: -CREATOR OWNER (Full Control) -System (Full control) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -System Administrators (Full Control) [Note 3] -SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read & Execute) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] -SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Write) [Notes 1, 2] -If any less restrictive permissions are present (and not specifically justified and approved), this is a finding.SRG-APP-000133-DB-000207<GroupDescription></GroupDescription>SQL2-00-025300The OS must limit privileges to the SQL Server backup directories and files.<VulnDiscussion>Backups must be protected from unauthorized deletion and modification. They must also be protected from unauthorized use in database restoration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001499Navigate to the SQL Server backup directory location. Right-click the folder, click Properties. On the Security tab, modify the security permissions, so that files and folders have at most the permissions listed below. Right-click each folder under the SQL Server backup folder, click Properties. On the Security tab, modify the security permissions, so that at most the following permissions are present. -CREATOR OWNER (Full Control) -System (Full control) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] -SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Write) [Notes 1, 2] -System Administrators (Full Control) [Note 3] -SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read & Execute) [Notes 1, 2] - - ------ - -Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control because these permissions are available only to the specific service when it is running and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.110).aspx. - -Note 2: Tips for adding a service SID/virtual account to a folder's permission list. -1) In Windows Explorer, right-click on the folder and select "Properties." -2) Select the "Security" tab -3) Click "Edit" -4) Click "Add" -5) Click "Locations" -6) Select the computer name -7) Search for the name -7.a) SQL Server Service -7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) -7.a.ii) Select the "MSSQL$<instance name>" user and click "OK" -7.b) SQL Agent Service -7.b.i) Type "NT SERVICE\SQL" and click "Check Names" -7.b.ii) Select the "SQLAgent$<instance name>" user and click "OK" -8) Click "OK" -9) Permission like a normal user from here - -Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only.Obtain the SQL Server backup directory location: from a command prompt, open the registry editor by typing regedit.exe, and pressing [ENTER]. Navigate to the following registry location: -HKEY_LOCAL_MACHINE ->> SOFTWARE ->> Microsoft ->> Microsoft SQL Server ->> [INSTANCE NAME] ->> MSSQLServer ->> BackupDirectory - -In the registry tree, the [INSTANCE NAME] for a SQL Server 2012 database engine instance is normally shown as "MSSQL11" followed by a period and the name that was specified for the SQL Server service at installation time. If multiple SQL Server instances are installed, each will have its own [INSTANCE NAME] node and subtree in the registry. - -The value in the Data column for the BackupDirectory registry entry is the file system path for the SQL Server 2012 backups. Also, review backup jobs to identify any additional directories used for backups. - -Navigate to each folder location using a command prompt or Windows Explorer. The following instructions assume that Windows Explorer is used. - -Verify that backup files and folders have only authorized privileges. Right-click the backup folder, click Properties. On the Security tab, verify that at most the following permissions are present: -CREATOR OWNER (Full Control) -System (Full control) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] -SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Write) [Notes 1, 2] -System Administrators (Full Control) [Note 3] -SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read & Execute) [Notes 1, 2] -If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - -Right-click each folder, if any, under the backup folder; click Properties. On the Security tab, verify that at most the permissions listed in the preceding paragraph are present. If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - - ------ - -Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control because these permissions are available only to the specific service when it is running and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.110).aspx. - -Note 2: Tips for adding a service SID/virtual account to a folder's permission list. -1) In Windows Explorer, right-click on the folder and select "Properties." -2) Select the "Security" tab -3) Click "Edit" -4) Click "Add" -5) Click "Locations" -6) Select the computer name -7) Search for the name -7.a) SQL Server Service -7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) -7.a.ii) Select the "MSSQL$<instance name>" user and click "OK" -7.b) SQL Agent Service -7.b.i) Type "NT SERVICE\SQL" and click "Check Names" -7.b.ii) Select the "SQLAgent$<instance name>" user and click "OK" -8) Click "OK" -9) Permission like a normal user from here - -Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only.SRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-004400SQL Server must not grant users direct access to the View Any Database permission.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -Privileges granted outside of SQL Server's role-based account assignments are more likely to go unmanaged and without oversight of granted access. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment. - -SQL Server's 'View Any Database' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. This administrative privilege must not be assigned directly to administrative user accounts (or any other user accounts). If any user accounts have direct access to administrative privileges, this access must be removed. - -Note that this does not apply to logins with names of the form '##MS...##'. These accounts are internal-use system principals provisioned by the DBMS, and required by it for specific purposes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001499Remove the 'View Any Database' permission access from the account that has direct access by running the following script: - -USE master -REVOKE VIEW ANY DATABASE TO <'account name'> -GO Obtain the list of accounts that have direct access to the server-level permission 'View Any Database' by running the following query: - -SELECT -who.name AS [Principal Name], -who.type_desc AS [Principal Type], -who.is_disabled AS [Principal Is Disabled], -what.state_desc AS [Permission State], -what.permission_name AS [Permission Name] -FROM -sys.server_permissions what -INNER JOIN sys.server_principals who -ON who.principal_id = what.grantee_principal_id -WHERE -what.permission_name = 'View Any Database' -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY -who.name -; -GO - -If any user accounts have direct access to the 'View Any Database' permission, this is a finding. - -Alternatively, to provide a combined list for all requirements of this type: -SELECT - what.permission_name AS [Permission Name], - what.state_desc AS [Permission State], - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name IN - ( - 'Administer bulk operations', - 'Alter any availability group', - 'Alter any connection', - 'Alter any credential', - 'Alter any database', - 'Alter any endpoint ', - 'Alter any event notification ', - 'Alter any event session ', - 'Alter any linked server', - 'Alter any login', - 'Alter any server audit', - 'Alter any server role', - 'Alter resources', - 'Alter server state ', - 'Alter Settings ', - 'Alter trace', - 'Authenticate server ', - 'Control server', - 'Create any database ', - 'Create availability group', - 'Create DDL event notification', - 'Create endpoint', - 'Create server role', - 'Create trace event notification', - 'External access assembly', - 'Shutdown', - 'Unsafe Assembly', - 'View any database', - 'View any definition', - 'View server state' - ) -AND who.name NOT LIKE '##MS%##' -AND who.type_desc <> 'SERVER_ROLE' -ORDER BY - what.permission_name, - who.name -; -GOSRG-APP-000063-DB-000018<GroupDescription></GroupDescription>SQL2-00-009710Owners of privileged accounts must use non-privileged accounts for non-administrative activities.<VulnDiscussion>Use of privileged accounts for non-administrative purposes puts data at risk of unintended or unauthorized loss, modification, or exposure. In particular, DBA accounts, if used for non-administration application development or application maintenance, can lead to excessive privileges where privileges are inherited by object owners. It may also lead to loss or compromise of application data where the elevated privileges bypass controls designed in and provided by applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000040Require that DBAs and other privileged users use non-privileged accounts for non-administrative activities.Review procedures and practices. If there is not a policy requiring owners of privileged accounts to use non-privileged accounts for non-administrative activities, this is a finding. If there is evidence that owners of privileged accounts do not adhere to this policy, this is a finding.SRG-APP-000035-DB-000007<GroupDescription></GroupDescription>SQL2-00-002500SQL Server must enforce access control policies to restrict the Alter any event notification permission to only authorized roles.<VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any event notification' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any event notification' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000022Remove the 'Alter any event notification' permission access from the role that is not authorized by executing the following query: - -REVOKE Alter any event notification TO <'role name'>Obtain the list of roles that are authorized for the SQL Server 'Alter any event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT -who.name AS [Principal Name], -who.type_desc AS [Principal Type], -who.is_disabled AS [Principal Is Disabled], -what.state_desc AS [Permission State], -what.permission_name AS [Permission Name] -FROM -sys.server_permissions what -INNER JOIN sys.server_principals who -ON who.principal_id = what.grantee_principal_id -WHERE -what.permission_name = 'Alter any event notification' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY -who.name -; -GO SRG-APP-000133-DB-000179<GroupDescription></GroupDescription>SQL2-00-015355Software, applications, and configuration files that are part of, or related to, the SQL Server 2012 installation must be audited.<VulnDiscussion>When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of applications and tools related to SQL Server can potentially have significant effects on the overall security of the system. Only qualified and authorized individuals shall be allowed to obtain access to components related to SQL Server for purposes of initiating changes, including upgrades and modifications. - -Unmanaged changes that occur to the software libraries or configuration can lead to unauthorized or compromised installations. - -Of particular note in this context is that any software installed for auditing and/or audit file management must be protected and audited.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-001297Include locations of all files, libraries, scripts, and executables that are part of, or related to, the SQL Server 2012 installation in the documentation. - -Ensure that files and folders that are part of, or related to, the SQL Server 2012 installation have auditing enabled. Right-click on the file/folder, click Properties. On the Security tab, click Advanced. On the Auditing tab, use the Add or Edit buttons and the dialogs that follow from them, to set up the following on at least one audit: -Type: All -Principal: Everyone -Access: Modify -Applies to: This Folder, subfolder, and files [where applicable]Obtain the SQL Server software directory location: from a command prompt, open the registry editor by typing regedit.exe and pressing [ENTER]. Navigate to the following registry location: -HKEY_LOCAL_MACHINE ->> SOFTWARE ->> Microsoft ->> Microsoft SQL Server ->> [INSTANCE NAME] ->> Setup ->> SQLBinRoot - -Determine the location of separate but related softare, such as audit file management tools. - -Verify that files and folders that are part of, or related to, the SQL Server 2012 installation have auditing enabled. Right-click on the file/folder, click Properties. On the Security tab, click Advanced. On the Auditing tab, verify -that the following is set up on at least one audit: -Type: All -Principal: Everyone -Access: Modify -Applies to: This Folder, subfolder, and files [where applicable] - -If the required audit settings are not configured, there is a risk that unauthorized changes to the software will go undetected, and this is a finding.SRG-APP-000516-DB-999900<GroupDescription></GroupDescription>SQL2-00-039100The SQL Server Browser service must be disabled if its use is not necessary.<VulnDiscussion>The SQL Server Browser simplifies the administration of SQL Server, particularly when multiple instances of SQL Server coexist on the same computer. It avoids the need to hard-assign port numbers to the instances and to set and maintain those port numbers in client systems. It enables administrators and authorized users to discover database management system instances, and the databases they support, over the network. - -This convenience also presents the possibility of unauthorized individuals gaining knowledge of the available SQL Server resources. Therefore, it is necessary to consider whether the SQL Server Browser is needed. Typically, if only a single instance is installed, using the default name (MSSQLSERVER) and port assignment (1433), the Browser is not adding any value. The more complex the installation, the more likely SQL Server Browser is to be helpful. - -This requirement is not intended to prohibit use of the Browser service in any circumstances; rather, it calls for administrators and management to consider whether the benefits of its use outweigh the potential negative consequences.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000366If SQL Server Browser is needed, document the justification and obtain the appropriate approvals. - -Where SQL Server Browser is judged unnecessary, in the Services tool, double-click on "SQL Server Browser" to open its "Properties" dialog. Set Startup Type to "Disabled". If Service Status is "Running", click on "Stop". Click on "OK".If the need for the SQL Server Browser service is documented, with appropriate approval, this is not a finding. - -Open the Services tool. - -Either navigate, via the Windows Start Menu and/or Control Panel, to "Administrative Tools", and select "Services" or at a command prompt, type "services.msc" and press the "Enter" key. - -Scroll to "SQL Server Browser". - -If its Startup Type is not shown as "Disabled", this is a finding.SRG-APP-000164-DB-000401<GroupDescription></GroupDescription>SQL2-00-038900If SQL Server authentication, using passwords, is employed, SQL Server must enforce the DoD standards for password complexity.<VulnDiscussion>Windows domain/enterprise authentication and identification must be used (SQL2-00-023600). Native SQL Server authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved. - -The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. - -In such cases, the DoD standards for password complexity must be implemented. - -The requirements for password complexity are: -a. minimum of 15 Characters, 1 of each of the following character sets: -- Upper-case -- Lower-case -- Numeric -- Special characters (e.g. ~ ! @ # $ % ^ & * ( ) _ + = - ' [ ] / ? > <)]; -b. Minimum number of characters changed from previous password: 50% of the minimum password length (that is, 8). - -To enforce this in SQL Server, configure each DBMS-managed login to inherit the rules from Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000192CCI-000193CCI-000194CCI-000195CCI-000205CCI-001619For each SQL Server Login identified in the Check as out of compliance: -In SQL Server Management Studio Object Explorer, navigate to <SQL Server instance name> >> Security >> Logins >> <login name>. Right-click, select Properties. Select the check box Enforce Password Policy. Click OK. - -Alternatively, for each identified Login, run the statement: -ALTER LOGIN <login name> CHECK_POLICY = ON;Run the statement: -SELECT - name -FROM - sys.sql_logins -WHERE - type_desc = 'SQL_LOGIN' - AND is_disabled = 0 - AND is_policy_checked = 0 ; - -If no account names are listed, this is not a finding. - -For each account name listed, determine whether it is documented as requiring exemption from the standard password complexity rules. If it is not, this is a finding.SRG-APP-000164-DB-000401<GroupDescription></GroupDescription>SQL2-00-038910If SQL Server authentication, using passwords, is employed, SQL Server must enforce the DoD standards for password lifetime.<VulnDiscussion>Windows domain/enterprise authentication and identification must be used (SQL2-00-023600). Native SQL Server authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved. - -The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. - -In such cases, the DoD standards for password lifetime must be implemented. - -The requirements for password lifetime are: -a. Password lifetime limits for interactive accounts: Minimum 24 hours, Maximum 60 days -b. Password lifetime limits for non-interactive accounts: Minimum 24 hours, Maximum 365 days -c. Number of password changes before an old one may be reused: Minimum of 5. - -To enforce this in SQL Server, configure each DBMS-managed login to inherit the rules from Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target SQL Server Installation 2012DISADPMS TargetSQL Server Installation 20122561CCI-000198CCI-000199For each SQL Server Login identified in the Check as out of compliance: -In SQL Server Management Studio Object Explorer, navigate to <SQL Server instance name> >> Security >> Logins >> <login name>. Right-click, select Properties. Select the check box Enforce Password Expiration. Click OK. - -Alternatively, for each identified Login, run the statement: -ALTER LOGIN <login name> CHECK_EXPIRATION = ON;Run the statement: -SELECT -name -FROM -sys.sql_logins -WHERE -type_desc = 'SQL_LOGIN' -AND is_disabled = 0 -AND is_expiration_checked = 0; - -If no account names are listed, this is not a finding. - -For each account name listed, determine whether it is documented as requiring exemption from the standard password lifetime rules, if it is not, this is a finding. diff --git a/StigData/Archive/SQL Server/U_SQL_Server_2012_Instance_STIG_V1R17_Manual-xccdf.log b/StigData/Archive/SQL Server/U_SQL_Server_2012_Instance_STIG_V1R17_Manual-xccdf.log new file mode 100644 index 000000000..b23ce327d --- /dev/null +++ b/StigData/Archive/SQL Server/U_SQL_Server_2012_Instance_STIG_V1R17_Manual-xccdf.log @@ -0,0 +1,2 @@ +V-40950::*::HardCodedRule(PermissionRule)@{DscResource = 'FileSystemAuditRuleEntry'; AccessControlEntry = @(@{Type = $null; Principal = 'Everyone'; ForcePrincipal = $null; Inheritance = 'This folder subfolders and files'; Rights = 'Traverse,ExecuteFile,ListDirectory,ReadData,ReadAttributes,ReadExtendedAttributes,CreateFiles,WriteData,CreateDirectories,AppendData,WriteAttributes,WriteExtendedAttributes,Delete,ReadPermissions'}); Force = $false; Path = $null; OrganizationValueTestString = 'the correct path is specified and does NOT conflict with RuleId V-69169'} +V-69169::*::HardCodedRule(PermissionRule)@{DscResource = 'FileSystemAuditRuleEntry'; AccessControlEntry = @(@{Type = $null; Principal = 'Everyone'; ForcePrincipal = $null; Inheritance = 'This folder subfolders and files'; Rights = 'Modify'}); Force = $false; Path = $null; OrganizationValueTestString = 'the correct path is specified and does NOT conflict with RuleId V-40950'} \ No newline at end of file diff --git a/StigData/Processed/SqlServer-2012-Instance-1.17.org.default.xml b/StigData/Processed/SqlServer-2012-Instance-1.17.org.default.xml index d426bfaf6..4f59dabea 100644 --- a/StigData/Processed/SqlServer-2012-Instance-1.17.org.default.xml +++ b/StigData/Processed/SqlServer-2012-Instance-1.17.org.default.xml @@ -1,12 +1,12 @@ - - + @@ -16,6 +16,6 @@ - + diff --git a/StigData/Processed/SqlServer-2012-Instance-1.17.xml b/StigData/Processed/SqlServer-2012-Instance-1.17.xml index e37baed96..e8149f8b5 100644 --- a/StigData/Processed/SqlServer-2012-Instance-1.17.xml +++ b/StigData/Processed/SqlServer-2012-Instance-1.17.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS), VPN, or IPSEC tunnel. @@ -345,6 +345,22 @@ Evidence of implementation includes records of backup events and physical review Evidence should match the backup plan as recorded in the system documentation. If backup procedures do not exist or are not implemented in accordance with the procedures, this is a finding. + + + <VulnDiscussion>SQL Server is capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations, or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. Components of the system that are unused and cannot be uninstalled must be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the components and features included in SQL Server and capable of being disabled (by configuration settings, permissions and privileges, etc.). Take note of those which are enabled. + +Review the system documentation to verify that the enabled components or features are documented and authorized. If any enabled components or features are not authorized, this is a finding. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). @@ -469,248 +485,299 @@ The SQL Server installation account requires privileges not required for SQL Ser If the account is used for anything beyond SQL Server installation, upgrade, and maintenance actions, this is a finding. - - <VulnDiscussion>Applications employ the concept of least privilege for specific duties and information systems (including specific functions, ports, protocols, and services). The concept of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of information systems. + + <VulnDiscussion>SQL Server DBAs, if assigned excessive OS privileges, could perform actions that could endanger the information system or hide evidence of malicious activity. -Unauthorized access to sensitive data may compromise the confidentiality of personnel privacy, threaten national security or compromise a variety of other sensitive operations. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +This requirement is intended to limit exposure due to operating from within a privileged account or role. The check and fix are based on the assumption that Role-Based Access Control (RBAC) is in effect, as mandated by other STIG requirements. They further assume that, as mandated elsewhere, the privileged accounts discussed here are distinct from the accounts used by the same people when not performing privileged functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False - Obtain the list of available user-defined server roles from system documentation. - -Obtain the list of available user-defined server roles from the SQL Server system by running the following script: -/********************************************************************************** - LIST ALL INDIRECT (via ROLES) ACCESS TO THE SERVER PERMISSION. - ***********************************************************************************/ -DECLARE @admin_Account_name sysname -SET @admin_Account_name = 'NO admin ACCOUNT found' -DECLARE @server_name sysname -SET @server_name = 'NO Server found' - -SELECT @server_name = name FROM sys.servers - WHERE server_id = 0 -SET @admin_Account_name = @server_name + '\Administrator' - -SELECT pe.grantee_principal_id - , pr.type AS 'Grantee_Type' - , pr.name AS 'Grantee_Name' - , pe.type - , pe.permission_name - , pe.state - , pe.state_desc - FROM sys.server_permissions pe - JOIN sys.server_principals pr - ON pe.grantee_principal_id = pr.principal_id - JOIN sys.server_principals ps - ON pe.grantor_principal_id = ps.principal_id - LEFT JOIN sys.server_principals us - ON us.principal_id = pe.major_id - WHERE pr.type IN ('R') - AND pe.grantee_principal_id > 10 - AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', - 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', - 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') - AND NOT pr.name = @admin_Account_name - ORDER BY CASE pe.state - WHEN 'D' THEN 1 - WHEN 'W' THEN 2 - WHEN 'G' THEN 3 - ELSE 4 - END - -If any listed user-defined roles are not found in the system documentation, this is a finding. - -Obtain the list assigned privileges for all user-defined roles in the system documentation. - -Check all SQL Server user-defined server roles for access rights as it relates to the separation of duties. Repeat steps for each user-defined server role. -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Server Roles >> right click <'user-defined server role name'> >> Properties >> General >> Securables. If any user-defined role is assigned privileges that are not documented in the system documentation, this is a finding. - -If any user-defined role contains permissions that are inconsistent with separation sensitive information assignment, this is a finding. + From the system security documentation, obtain the list of SQL Server DBA accounts, the OS/domain Group(s) representing those DBAs' job role(s), and the OS permissions required by that/those role(s). -If system access requires more than one level of sensitive information access and the user-defined role names do not clearly differentiate between the different levels of sensitive information, this is a finding. - - - <VulnDiscussion>Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action. -Additionally, the person or entity accountable for monitoring the activity must be separate as well. To meet this requirement, applications, when applicable, shall be divided where functionality is based on roles and duties. Examples of separation of duties include: (i) mission functions and distinct information system support functions are divided among different individuals/roles; (ii) different individuals perform information system support functions (e.g., system management, systems programming, configuration management, quality assurance and testing, network security); (iii) security personnel who administer access control functions do not administer audit functions; and (iv) different administrator accounts for different roles. +To review local accounts and groups: -Privileges granted outside the role of the application user job function are more likely to go unmanaged or without oversight for authorization. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Check for direct user assignment to server permissions by running the following script: -/********************************************************************************** - LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT - SYSTEM ADMINISTRATOR accounts. DO NOT LIST ROLES. -***********************************************************************************/ -DECLARE @admin_Account_name sysname -SET @admin_Account_name = 'NO administrator account found' -DECLARE @server_name sysname -SET @server_name = 'NO Server found' +Log on to the Windows server hosting SQL Server, using an account with administrator privileges. -SELECT @server_name = name FROM sys.servers - WHERE server_id = 0 -SET @admin_Account_name = @server_name + '\Administrator' +From a command prompt opened as administrator, type gpedit.msc, and press [ENTER]. In Group Policy Editor, navigate to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment. Scan the list to determine which privileges are assigned to the Group(s) representing the SQL Server DBA job role(s). If any privileges are assigned that are not required by these roles, this is a finding. -SELECT pe.grantee_principal_id - , pr.type AS 'Grantee_Type' - , pr.name AS 'Grantee_Name' - , pe.type - , pe.permission_name - , pe.state - , pe.state_desc - FROM sys.server_permissions pe - JOIN sys.server_principals pr - ON pe.grantee_principal_id = pr.principal_id - JOIN sys.server_principals ps - ON pe.grantor_principal_id = ps.principal_id - LEFT JOIN sys.server_principals us - ON us.principal_id = pe.major_id - WHERE pr.type IN ('K', 'S', 'U') - AND pe.grantee_principal_id > 10 - AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', - 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', - 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') - AND NOT pr.name = @admin_Account_name - AND NOT pe.permission_name = 'connect sql' - ORDER BY CASE pr.type - WHEN 'K' THEN 1 - WHEN 'S' THEN 2 - WHEN 'U' THEN 3 - ELSE 4 - END +From the command prompt, type lusrmgr.msc, and press [ENTER]. In the Local Users and Groups console, navigate to Users. Right-click each DBA user. Click Properties. Click the 'Member of' tab. If any parent groups are listed that are not specific to DBA roles, this is a finding. -If any user account list indicates direct access to any server permission, this is a finding. +In the Local Users and Groups console, navigate to Groups. Right-click each DBA Group. Click Properties. Review the list of group members. If any account that does not represent a DBA is listed, this is a finding. -Obtain the list of available user-defined server roles from system documentation. -Obtain the list of available user-defined server roles from the SQL Server system by running the following script: -/********************************************************************************** - LIST ALL INDIRECT (via ROLES) ACCESS TO THE SERVER PERMISSION. - ***********************************************************************************/ -DECLARE @admin_Account_name sysname -SET @admin_Account_name = 'NO admin ACCOUNT found' -DECLARE @server_name sysname -SET @server_name = 'NO Server found' +To review domain-level accounts and groups: -SELECT @server_name = name FROM sys.servers - WHERE server_id = 0 -SET @admin_Account_name = @server_name + '\Administrator' +Log on to a domain controller with the necessary privileges. -SELECT pe.grantee_principal_id - , pr.type AS 'Grantee_Type' - , pr.name AS 'Grantee_Name' - , pe.type - , pe.permission_name - , pe.state - , pe.state_desc - FROM sys.server_permissions pe - JOIN sys.server_principals pr - ON pe.grantee_principal_id = pr.principal_id - JOIN sys.server_principals ps - ON pe.grantor_principal_id = ps.principal_id - LEFT JOIN sys.server_principals us - ON us.principal_id = pe.major_id - WHERE pr.type IN ('R') - AND pe.grantee_principal_id > 10 - AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', - 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', - 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') - AND NOT pr.name = @admin_Account_name - AND NOT pe.permission_name = 'connect sql' - ORDER BY CASE pe.state - WHEN 'D' THEN 1 - WHEN 'W' THEN 2 - WHEN 'G' THEN 3 - ELSE 4 - END +Open Active Directory Users and Computers (available from menus or run dsa.msc) -If any listed user-defined roles are not found in the system documentation, this is a finding. +Determine the location of the accounts or groups to be reviewed. The default is the Users container, but they could have been created or moved to an Organizational Unit (OU) that is domain specific. -Obtain the list of assigned privileges for all user-defined roles in the system documentation. +Right-click each DBA user. Click Properties. Click the 'Member of' tab. If any parent groups are listed that are not specific to DBA roles, this is a finding. -Check all SQL Server user-defined server roles for access rights as it relates to the separation of duties. Repeat steps for each user-defined server role. -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Server Roles >> right click <'user-defined server role name'> >> Properties >> General >> Securables. If any roles are found that do not enforce separation of duties, this is a finding. +Right-click each DBA Group. Click Properties. Select the 'Members' tab. Review the list of group members. If any account that does not represent a DBA is listed, this is a finding. - - <VulnDiscussion>Discretionary Access Control (DAC) is based on the premise that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). + + <VulnDiscussion>This requirement is intended to limit exposure due to operating from within a privileged account or role. The inclusion of role is intended to address those situations where an access control policy, such as Role-Based Access Control (RBAC), is being implemented and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account. -These DAC concepts extend to the server level. Server instances have the potential for the access controls to propagate without limit, resulting in unauthorized access. +Audit of privileged activity may require physical separation, employing information systems on which the user does not have privileged access. -The DBMS must ensure the recipient of server permissions possesses only the access intended. The DBMS must enforce the ability to limit unauthorized rights propagation. If propagation is not prevented, users can continue to grant rights to other users without limit.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +To limit exposure and provide forensic history of activity when operating from within a privileged account or role, SQL Server does support organizational requirements that users of information system accounts, or roles, with access to an organization-defined list of security functions or security-relevant information, use non-privileged accounts, or roles, when accessing other (non-security) system functions. + +SQL Server provides access logging that ensures users who are granted a privileged role (or roles) have their privileged activity logged. DBAs, if assigned excessive privileges, could perform actions that endanger the information system or hide evidence of malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False - Check for rights propagation assignment to DBMS server permissions by running the following query: - -USE master; -SELECT * -FROM sys.server_permissions -WHERE state_desc = 'GRANT_WITH_GRANT_OPTION'; + Obtain the list of all DBAs. +Obtain documented role assignments for each DBA. +Obtain from system documentation or use SQL Server to determine privilege assignment of user-defined roles. -If any of the permissions listed have not been documented and approved as requiring GRANT_WITH_GRANT_OPTION, this is a finding. - - - <VulnDiscussion>Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) are employed by organizations to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, domains). +Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Logins >> right click <'administrator account name'> >> Properties >> User >> Securables. -DAC is a type of access control methodology serving as a means of restricting access to objects and data based on the identity of subjects and/or groups to which they belong. It is discretionary in the sense that application users with the appropriate permissions to access an application resource or data have the discretion to pass that permission on to another user either directly or indirectly. +If any item in the 'Permission' listing, for each highlighted item that exists in the 'Securables' listing, has excessive privileges, this is a finding. -Data protection requirements may result in a DAC policy being specified as part of the application design. Discretionary access controls would be employed at the application level to restrict and control access to application objects and data, thereby providing increased information security for the organization. +Navigate from 'Securables' to 'Server Roles'. -When DAC controls are employed, those controls must limit sharing to named application users, groups of users, or both. The application DAC controls must also limit the propagation of access rights and have the ability to exclude access to data down to the granularity of a single user. +If any checked 'Server roles' are determined to be excessive privileges, this is a finding. -Databases using DAC must have the ability for the owner of an object or information to assign or revoke rights to view or modify the object or information. If the owner of an object or information does not have rights to exclude access to an object or information at a user level, users may gain access to objects and information they are not authorized to view/modify.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Check for direct user assignment to server permissions by running the following script: -/********************************************************************************** - LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT - SYSTEM ADMINISTRATOR accounts. DO NOT LIST ROLES. -***********************************************************************************/ -DECLARE @admin_Account_name sysname -SET @admin_Account_name = 'NO Administrator account found' -DECLARE @server_name sysname -SET @server_name = 'NO Server found' +Navigate from 'Server Roles' to 'Users mapped to the login'. -SELECT @server_name = name FROM sys.servers - WHERE server_id = 0 -SET @admin_Account_name = @server_name + '\Administrator' +If any checked 'Database role membership' of each highlighted and checked 'Database' are determined to be excessive privileges, this is a finding. + + + <VulnDiscussion>The principle of Least Privilege must be applied to the ability of users to access system tables, system management information, other configuration information, and metadata. Unauthorized access to this data could result in unauthorized changes to database objects, access controls, or SQL Server configuration. Only database administrators and other authorized users must be allowed such access. -SELECT pe.grantee_principal_id - , pr.type AS 'Grantee_Type' - , pr.name AS 'Grantee_Name' - , pe.type - , pe.permission_name - , pe.state - , pe.state_desc - FROM sys.server_permissions pe - JOIN sys.server_principals pr - ON pe.grantee_principal_id = pr.principal_id - JOIN sys.server_principals ps - ON pe.grantor_principal_id = ps.principal_id - LEFT JOIN sys.server_principals us - ON us.principal_id = pe.major_id - WHERE pr.type IN ('K', 'S', 'U') - AND pe.grantee_principal_id > 10 - AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', - 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', - 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') - AND NOT pr.name = @admin_Account_name - ORDER BY CASE pr.type - WHEN 'K' THEN 1 - WHEN 'S' THEN 2 - WHEN 'U' THEN 3 - ELSE 4 - END +To aid in tracking and administering such permissions, individual logins must not be directly granted permissions or built-in server roles. Instead, user-defined server roles must be created, with the permissions and built-in server roles granted to them; the individual logins must be assigned to the appropriate user-defined server roles. -If any user account list indicates direct access to any server permission, this is a finding. +The built-in server role "sysadmin" is a partial exception. This cannot be granted to a user-defined role, only to a login account. Most (not necessarily all) database administrators will need to be members of sysadmin. Without this, most DBCC commands and the system stored procedures/functions listed below are unavailable. The users who require such access must be documented and approved. -Obtain the list of available user-defined server roles from system documentation. +In addition, if the site uses backup-restore software that connects to SQL Server via the Virtual Device Interface (VDI), the account used by that software must have the sysadmin role. (See Microsoft Knowledge Base article 2926557, http://support.microsoft.com/kb/2926557). If this applies, it must be documented and approved. + +Stored procedures/functions available only to the sysadmin role: +fn_yukonsecuritymodelrequired +sp_add_agent_parameter +sp_add_agent_profile +sp_adddatatype +sp_adddistributiondb +sp_adddistributor +sp_addqreader_agent +sp_addsubscriber +sp_addsubscriber_schedule +sp_addtabletocontents +sp_attachsubscription +sp_cdc_cleanup_change_table +sp_cdc_disable_db +sp_cdc_disable_table +sp_cdc_drop_job +sp_cdc_enable_db +sp_cdc_enable_table +sp_cdc_restoredb +sp_cdc_vupgrade +sp_certify_removable +sp_change_agent_parameter +sp_change_agent_profile +sp_change_subscription_properties +sp_change_users_login +sp_changedistpublisher +sp_changedistributiondb +sp_changedistributor_password +sp_changedistributor_property +sp_changemergesubscription +sp_changeqreader_agent +sp_changereplicationserverpasswords +sp_changesubscriptiondtsinfo +sp_checkinvalidivarticle +sp_copysubscription +sp_create_removable +sp_cycle_errorlog +sp_dbcmptlevel +sp_dbmmonitoraddmonitoring +sp_dbmmonitorchangealert +sp_dbmmonitordropalert +sp_dbmmonitordropmonitoring +sp_dbmmonitorhelpalert +sp_dbmmonitorhelpmonitoring +sp_dbmmonitorresults +sp_dbmmonitorupdate +sp_dbremove +sp_drop_agent_parameter +sp_drop_agent_profile +sp_dropdatatypemapping +sp_dropdistpublisher +sp_dropdistributiondb +sp_dropdistributor +sp_dropmergepullsubscription +sp_droppullsubscription +sp_dropsubscriber +sp_dsninfo +sp_enumdsn +sp_flush_commit_table_on_demand +sp_generate_agent_parameter +sp_get_distributor +sp_get_Oracle_publisher_metadata +sp_getagentparameterlist +sp_getdefaultdatatypemapping +sp_grant_publication_access +sp_help_agent_default +sp_help_agent_parameter +sp_help_agent_profile +sp_helpdistpublisher +sp_helpdistributor +sp_helpmergesubscription +sp_helpqreader_agent +sp_helpreplicationdboption +sp_identitycolumnforreplication +sp_IHValidateRowFilter +sp_IHXactSetJob +sp_link_publication +sp_monitor +sp_MSadd_distribution_agent +sp_MSadd_logreader_agent +sp_MSadd_merge_agent +sp_MSadd_snapshot_agent +sp_MSadd_subscriber_schedule +sp_MSadd_tracer_history +sp_MSadd_tracer_token +sp_MScdc_cleanup_job +sp_MScdc_db_ddl_event +sp_MScdc_ddl_event +sp_MSchange_distribution_agent_properties +sp_MSchange_logreader_agent_properties +sp_MSchange_merge_agent_properties +sp_MSchange_snapshot_agent_properties +sp_MSchangedynamicsnapshotjobatdistributor +sp_MSchangedynsnaplocationatdistributor +sp_MScheck_pull_access +sp_MScleanupmergepublisher_internal +sp_MSclear_dynamic_snapshot_location +sp_MScreate_dist_tables +sp_MSdbuserpriv +sp_MSdeletefoldercontents +sp_MSdrop_6x_replication_agent +sp_MSdrop_merge_agent +sp_MSdrop_snapshot_dirs +sp_MSdropmergedynamicsnapshotjob +sp_MSdynamicsnapshotjobexistsatdistributor +sp_MSenumallpublications +sp_MSfetchAdjustidentityrange +sp_MSfix_6x_tasks +sp_MSforce_drop_distribution_jobs +sp_MSget_agent_names +sp_MSget_jobstate +sp_MSget_oledbinfo +sp_MSget_publication_from_taskname +sp_MSgetdbversion +sp_MSgetmaxsnapshottimestamp +sp_MShelp_repl_agent +sp_MShelp_replication_status +sp_MShelp_snapshot_agent +sp_MShelpconflictpublications +sp_MShelpdynamicsnapshotjobatdistributor +sp_MShelplogreader_agent +sp_MShelpsnapshot_agent +sp_MShelptranconflictcounts +sp_MSinit_publication_access +sp_MSreinit_failed_subscriptions +sp_MSremoveoffloadparameter +sp_MSrepl_backup_complete +sp_MSrepl_backup_start +sp_MSrepl_createdatatypemappings +sp_MSrepl_dropdatatypemappings +sp_MSrepl_enumarticlecolumninfo +sp_MSrepl_enumpublications +sp_MSrepl_enumpublishertables +sp_MSrepl_enumsubscriptions +sp_MSrepl_enumtablecolumninfo +sp_MSrepl_getdistributorinfo +sp_MSrepl_startup_internal +sp_MSreplagentjobexists +sp_MSreplcheck_permission +sp_MSreplcheck_pull +sp_MSreplcheck_subscribe +sp_MSreplcheck_subscribe_withddladmin +sp_MSreplcopyscriptfile +sp_MSreplremoveuncdir +sp_MSsetalertinfo +sp_MSSetServerProperties +sp_MSsetupnosyncsubwithlsnatdist +sp_MSsetupnosyncsubwithlsnatdist_cleanup +sp_MSsetupnosyncsubwithlsnatdist_helper +sp_MSstartdistribution_agent +sp_MSstartmerge_agent +sp_MSstartsnapshot_agent +sp_MSstopdistribution_agent +sp_MSstopmerge_agent +sp_MSstopsnapshot_agent +sp_MSupdate_agenttype_default +sp_oledbinfo +sp_procoption +sp_removedbreplication +sp_removesrvreplication +sp_replication_agent_checkup +sp_replicationdboption +sp_resetstatus +sp_restoredbreplication +sp_SetAutoSAPasswordAndDisable +sp_setdefaultdatatypemapping +sp_updatestats +sp_validatelogins +sp_vupgrade_mergeobjects +sp_vupgrade_replication +sp_vupgrade_replsecurity_metadata +xp_repl_convert_encrypt_sysadmin_wrapper +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Use SQL Server and system documentation to determine privilege assignment of user-defined roles. + +Determine which user-defined roles grant privileges to system tables and configuration data stored in SQL Server. + +For each Login: + +In SQL Server Management Studio, Object Explorer, expand <SQL Server instance> >> Security >> Logins >> Right-click <login account name> >> Properties >> User >> Securables. + +If any item in the Explicit Permissions listing, for each highlighted item that exists in the Securables listing, indicates direct permission access, and that permission is anything other than Connect SQL, this is a finding. + +Navigate from Securables to Server Roles. + +If any Server Roles are checked from the following list, indicating direct permission access, this is a finding: +bulkadmin +dbcreator +diskadmin +processadmin +securityadmin +serveradmin +setupadmin + +If the sysadmin server role is checked, review system documentation to determine whether this login's need for the sysadmin role is documented and approved. If it is not, this is a finding. + +If any user-defined server roles with system table or configuration data privileges are checked, review system documentation to determine whether this login's need for the role is documented and approved. If it is not, this is a finding. + +Navigate from Server Roles to User Mapping. Select in turn each entry where the User column is non-blank. If any Database Roles are checked from the following list, indicating direct permission access, this is a finding: +db_accessadmin +db_backupoperator +db_datareader +db_datawriter +db_ddladmin +db_denydatareader +db_denydatawriter +db_owner +db_securityadmin + + + <VulnDiscussion>Applications employ the concept of least privilege for specific duties and information systems (including specific functions, ports, protocols, and services). The concept of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of information systems. + +Unauthorized access to sensitive data may compromise the confidentiality of personnel privacy, threaten national security or compromise a variety of other sensitive operations. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain the list of available user-defined server roles from system documentation. Obtain the list of available user-defined server roles from the SQL Server system by running the following script: /********************************************************************************** @@ -754,27 +821,29 @@ SELECT pe.grantee_principal_id If any listed user-defined roles are not found in the system documentation, this is a finding. -Obtain the list of user role assignments in the system documentation. +Obtain the list assigned privileges for all user-defined roles in the system documentation. -Check all SQL Server user-defined server roles for authorized and documented permission assignments. Repeat steps for each user-defined server role. -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Server Roles >> right click <'user-defined server role name'> >> Properties >> Members. If any roles are found that are not authorized and documented, this is a finding. - - - <VulnDiscussion>Non-DAC controls are determined by policy makers and are managed centrally or by a central authority. These controls must not be changed at the discretion of ordinary application users. Data protection requirements may result in a non-DAC policy being specified as part of the application design. Non-DACs are employed at the application level to restrict and control access to application data, thereby providing increased information security for the organization. +Check all SQL Server user-defined server roles for access rights as it relates to the separation of duties. Repeat steps for each user-defined server role. +Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Server Roles >> right click <'user-defined server role name'> >> Properties >> General >> Securables. If any user-defined role is assigned privileges that are not documented in the system documentation, this is a finding. -SQL Server Non-DAC is maintained through the use of Roles. Roles are set up within SQL Server to grant user accounts read and/or write permissions to system objects: databases, tables, columns, etc. After a role is created, user accounts can be assigned to a role granting them permissions of that role. +If any user-defined role contains permissions that are inconsistent with separation sensitive information assignment, this is a finding. -If users have permissions to database objects that they are not authorized to have, the user account that has access to the unauthorized database object must be removed from the role that grants that access. Policy rule sets would be developed to establish that each user receives only the information to which the user is authorized. +If system access requires more than one level of sensitive information access and the user-defined role names do not clearly differentiate between the different levels of sensitive information, this is a finding. + + + <VulnDiscussion>Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action. -Frequently, roles grant access to multiple privileges; if a user is authorized and determined to need access to authorized privilege granted by a role, and unauthorized for other privileges of that same role, it may be necessary to split the privileges of one role into two roles.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +Additionally, the person or entity accountable for monitoring the activity must be separate as well. To meet this requirement, applications, when applicable, shall be divided where functionality is based on roles and duties. Examples of separation of duties include: (i) mission functions and distinct information system support functions are divided among different individuals/roles; (ii) different individuals perform information system support functions (e.g., system management, systems programming, configuration management, quality assurance and testing, network security); (iii) security personnel who administer access control functions do not administer audit functions; and (iv) different administrator accounts for different roles. + +Privileges granted outside the role of the application user job function are more likely to go unmanaged or without oversight for authorization. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False Check for direct user assignment to server permissions by running the following script: /********************************************************************************** -LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT -SYSTEM ADMINISTRATOR ACCOUNTS. DO NOT LIST ROLES. + LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT + SYSTEM ADMINISTRATOR accounts. DO NOT LIST ROLES. ***********************************************************************************/ DECLARE @admin_Account_name sysname SET @admin_Account_name = 'NO administrator account found' @@ -782,15 +851,246 @@ DECLARE @server_name sysname SET @server_name = 'NO Server found' SELECT @server_name = name FROM sys.servers -WHERE server_id = 0 -SET @admin_Account_name = @server_name + '\Administrator' + WHERE server_id = 0 +SET @admin_Account_name = @server_name + '\Administrator' SELECT pe.grantee_principal_id -, pr.type AS 'Grantee_Type' -, pr.name AS 'Grantee_Name' -, pe.type -, pe.permission_name -, pe.state + , pr.type AS 'Grantee_Type' + , pr.name AS 'Grantee_Name' + , pe.type + , pe.permission_name + , pe.state + , pe.state_desc + FROM sys.server_permissions pe + JOIN sys.server_principals pr + ON pe.grantee_principal_id = pr.principal_id + JOIN sys.server_principals ps + ON pe.grantor_principal_id = ps.principal_id + LEFT JOIN sys.server_principals us + ON us.principal_id = pe.major_id + WHERE pr.type IN ('K', 'S', 'U') + AND pe.grantee_principal_id > 10 + AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', + 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', + 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') + AND NOT pr.name = @admin_Account_name + AND NOT pe.permission_name = 'connect sql' + ORDER BY CASE pr.type + WHEN 'K' THEN 1 + WHEN 'S' THEN 2 + WHEN 'U' THEN 3 + ELSE 4 + END + +If any user account list indicates direct access to any server permission, this is a finding. + +Obtain the list of available user-defined server roles from system documentation. + +Obtain the list of available user-defined server roles from the SQL Server system by running the following script: +/********************************************************************************** + LIST ALL INDIRECT (via ROLES) ACCESS TO THE SERVER PERMISSION. + ***********************************************************************************/ +DECLARE @admin_Account_name sysname +SET @admin_Account_name = 'NO admin ACCOUNT found' +DECLARE @server_name sysname +SET @server_name = 'NO Server found' + +SELECT @server_name = name FROM sys.servers + WHERE server_id = 0 +SET @admin_Account_name = @server_name + '\Administrator' + +SELECT pe.grantee_principal_id + , pr.type AS 'Grantee_Type' + , pr.name AS 'Grantee_Name' + , pe.type + , pe.permission_name + , pe.state + , pe.state_desc + FROM sys.server_permissions pe + JOIN sys.server_principals pr + ON pe.grantee_principal_id = pr.principal_id + JOIN sys.server_principals ps + ON pe.grantor_principal_id = ps.principal_id + LEFT JOIN sys.server_principals us + ON us.principal_id = pe.major_id + WHERE pr.type IN ('R') + AND pe.grantee_principal_id > 10 + AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', + 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', + 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') + AND NOT pr.name = @admin_Account_name + AND NOT pe.permission_name = 'connect sql' + ORDER BY CASE pe.state + WHEN 'D' THEN 1 + WHEN 'W' THEN 2 + WHEN 'G' THEN 3 + ELSE 4 + END + +If any listed user-defined roles are not found in the system documentation, this is a finding. + +Obtain the list of assigned privileges for all user-defined roles in the system documentation. + +Check all SQL Server user-defined server roles for access rights as it relates to the separation of duties. Repeat steps for each user-defined server role. +Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Server Roles >> right click <'user-defined server role name'> >> Properties >> General >> Securables. If any roles are found that do not enforce separation of duties, this is a finding. + + + <VulnDiscussion>Discretionary Access Control (DAC) is based on the premise that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). + +These DAC concepts extend to the server level. Server instances have the potential for the access controls to propagate without limit, resulting in unauthorized access. + +The DBMS must ensure the recipient of server permissions possesses only the access intended. The DBMS must enforce the ability to limit unauthorized rights propagation. If propagation is not prevented, users can continue to grant rights to other users without limit.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Check for rights propagation assignment to DBMS server permissions by running the following query: + +USE master; +SELECT * +FROM sys.server_permissions +WHERE state_desc = 'GRANT_WITH_GRANT_OPTION'; + +If any of the permissions listed have not been documented and approved as requiring GRANT_WITH_GRANT_OPTION, this is a finding. + + + <VulnDiscussion>Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) are employed by organizations to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, domains). + +DAC is a type of access control methodology serving as a means of restricting access to objects and data based on the identity of subjects and/or groups to which they belong. It is discretionary in the sense that application users with the appropriate permissions to access an application resource or data have the discretion to pass that permission on to another user either directly or indirectly. + +Data protection requirements may result in a DAC policy being specified as part of the application design. Discretionary access controls would be employed at the application level to restrict and control access to application objects and data, thereby providing increased information security for the organization. + +When DAC controls are employed, those controls must limit sharing to named application users, groups of users, or both. The application DAC controls must also limit the propagation of access rights and have the ability to exclude access to data down to the granularity of a single user. + +Databases using DAC must have the ability for the owner of an object or information to assign or revoke rights to view or modify the object or information. If the owner of an object or information does not have rights to exclude access to an object or information at a user level, users may gain access to objects and information they are not authorized to view/modify.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Check for direct user assignment to server permissions by running the following script: +/********************************************************************************** + LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT + SYSTEM ADMINISTRATOR accounts. DO NOT LIST ROLES. +***********************************************************************************/ +DECLARE @admin_Account_name sysname +SET @admin_Account_name = 'NO Administrator account found' +DECLARE @server_name sysname +SET @server_name = 'NO Server found' + +SELECT @server_name = name FROM sys.servers + WHERE server_id = 0 +SET @admin_Account_name = @server_name + '\Administrator' + +SELECT pe.grantee_principal_id + , pr.type AS 'Grantee_Type' + , pr.name AS 'Grantee_Name' + , pe.type + , pe.permission_name + , pe.state + , pe.state_desc + FROM sys.server_permissions pe + JOIN sys.server_principals pr + ON pe.grantee_principal_id = pr.principal_id + JOIN sys.server_principals ps + ON pe.grantor_principal_id = ps.principal_id + LEFT JOIN sys.server_principals us + ON us.principal_id = pe.major_id + WHERE pr.type IN ('K', 'S', 'U') + AND pe.grantee_principal_id > 10 + AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', + 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', + 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') + AND NOT pr.name = @admin_Account_name + ORDER BY CASE pr.type + WHEN 'K' THEN 1 + WHEN 'S' THEN 2 + WHEN 'U' THEN 3 + ELSE 4 + END + +If any user account list indicates direct access to any server permission, this is a finding. + +Obtain the list of available user-defined server roles from system documentation. + +Obtain the list of available user-defined server roles from the SQL Server system by running the following script: +/********************************************************************************** + LIST ALL INDIRECT (via ROLES) ACCESS TO THE SERVER PERMISSION. + ***********************************************************************************/ +DECLARE @admin_Account_name sysname +SET @admin_Account_name = 'NO admin ACCOUNT found' +DECLARE @server_name sysname +SET @server_name = 'NO Server found' + +SELECT @server_name = name FROM sys.servers + WHERE server_id = 0 +SET @admin_Account_name = @server_name + '\Administrator' + +SELECT pe.grantee_principal_id + , pr.type AS 'Grantee_Type' + , pr.name AS 'Grantee_Name' + , pe.type + , pe.permission_name + , pe.state + , pe.state_desc + FROM sys.server_permissions pe + JOIN sys.server_principals pr + ON pe.grantee_principal_id = pr.principal_id + JOIN sys.server_principals ps + ON pe.grantor_principal_id = ps.principal_id + LEFT JOIN sys.server_principals us + ON us.principal_id = pe.major_id + WHERE pr.type IN ('R') + AND pe.grantee_principal_id > 10 + AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', + 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', + 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') + AND NOT pr.name = @admin_Account_name + ORDER BY CASE pe.state + WHEN 'D' THEN 1 + WHEN 'W' THEN 2 + WHEN 'G' THEN 3 + ELSE 4 + END + +If any listed user-defined roles are not found in the system documentation, this is a finding. + +Obtain the list of user role assignments in the system documentation. + +Check all SQL Server user-defined server roles for authorized and documented permission assignments. Repeat steps for each user-defined server role. +Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Server Roles >> right click <'user-defined server role name'> >> Properties >> Members. If any roles are found that are not authorized and documented, this is a finding. + + + <VulnDiscussion>Non-DAC controls are determined by policy makers and are managed centrally or by a central authority. These controls must not be changed at the discretion of ordinary application users. Data protection requirements may result in a non-DAC policy being specified as part of the application design. Non-DACs are employed at the application level to restrict and control access to application data, thereby providing increased information security for the organization. + +SQL Server Non-DAC is maintained through the use of Roles. Roles are set up within SQL Server to grant user accounts read and/or write permissions to system objects: databases, tables, columns, etc. After a role is created, user accounts can be assigned to a role granting them permissions of that role. + +If users have permissions to database objects that they are not authorized to have, the user account that has access to the unauthorized database object must be removed from the role that grants that access. Policy rule sets would be developed to establish that each user receives only the information to which the user is authorized. + +Frequently, roles grant access to multiple privileges; if a user is authorized and determined to need access to authorized privilege granted by a role, and unauthorized for other privileges of that same role, it may be necessary to split the privileges of one role into two roles.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Check for direct user assignment to server permissions by running the following script: +/********************************************************************************** +LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT +SYSTEM ADMINISTRATOR ACCOUNTS. DO NOT LIST ROLES. +***********************************************************************************/ +DECLARE @admin_Account_name sysname +SET @admin_Account_name = 'NO administrator account found' +DECLARE @server_name sysname +SET @server_name = 'NO Server found' + +SELECT @server_name = name FROM sys.servers +WHERE server_id = 0 +SET @admin_Account_name = @server_name + '\Administrator' + +SELECT pe.grantee_principal_id +, pr.type AS 'Grantee_Type' +, pr.name AS 'Grantee_Name' +, pe.type +, pe.permission_name +, pe.state , pe.state_desc FROM sys.server_permissions pe JOIN sys.server_principals pr @@ -1369,19 +1669,117 @@ If the "SQL Server Reporting Services (MSSQLSERVER)" service does not exist, thi If the "SQL Server Reporting Services (MSSQLSERVER)" status is "Started" or the "Startup Type" is not set to "Disabled", this is a finding. - - <VulnDiscussion>Security faults with software applications and operating systems are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. + + <VulnDiscussion>When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. -Any time new software code is introduced to a system there is the potential for unintended consequences. There have been documented instances where the application of a patch has caused problems with system integrity or availability. Due to information system integrity and availability concerns, organizations must give careful consideration to the methodology used to carry out automatic updates. +If any user were allowed to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. The DBMS software libraries contain the executables used by the DBMS to operate. Unauthorized access to the libraries can result in compromised installations. This may in turn jeopardize data stored in the DBMS and/or operation of the host system. -If SQL Server were no longer supported, no patches from Microsoft would address newly discovered security vulnerabilities. Unpatched software is vulnerable to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +Accordingly, only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. + +Of particular note in this context is that any software installed for auditing and/or audit file management must be protected and monitored.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False - Check Microsoft's list of supported SQL Server versions. To locate the correct web page, perform a web search for "Microsoft SQL Server end of support." + Obtain the SQL Server software directory location: from a command prompt, open the registry editor by typing regedit.exe and pressing [ENTER]. Navigate to the following registry location: +HKEY_LOCAL_MACHINE +>> SOFTWARE +>> Microsoft +>> Microsoft SQL Server +>> [INSTANCE NAME] +>> Setup +>> SQLBinRoot -To be considered supported, Microsoft must report that the version is supported by security patches to known vulnerabilities. +In the registry tree, the [INSTANCE NAME] for a SQL Server 2012 database engine instance is normally shown as "MSSQL11" followed by a period and the name that was specified for the SQL Server service at installation time. If multiple SQL Server instances are installed, each will have its own [INSTANCE NAME] node and subtree in the registry. + +The value in the Data column for the SQLBinRoot registry entry is the file system path for the SQL Server 2012 binaries. Navigate to that folder location using a command prompt or Windows Explorer. The following instructions assume that Windows Explorer is used. + +Verify that files and folders that are part of the SQL Server 2012 instance have only authorized privileges. Right-click the binaries (\binn) folder, click Properties. On the Security tab, verify that at most the following permissions are present: +Trusted Installer (Full Control) +CREATOR OWNER (Full Control) +SYSTEM (Full Control) +Administrators (Full Control) [See Note 3] +Users (Read, List Folder Contents, Read & Execute) +Creator Owner (Special Permissions - Full control - Subfolders and files only) +All Application Packages (Read & Execute) [Only as needed - see Note 4] +SQL Server Service SID OR Service Account (Read & Execute) [Notes 1, 2] +SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Full Control) [Notes 1, 2] +SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read & Execute) [Notes 1, 2] +System Administrators (Full Control) [Note 3] + +If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. + +Right-click each folder under the binaries folder; click Properties. On the Security tab, verify that at most the permissions listed in the preceding paragraph are present. +If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. + +Right-click the \Install folder, which is a peer of \binn, under ...\MSSQL. On the Security tab, verify that at most the permissions listed in the preceding paragraphs are present. If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. + + +Locate the ...\Microsoft SQL Server\110\Shared folder, either by stepping up the tree in Windows Explorer or by finding the file path in the registry at: +HKEY_LOCAL_MACHINE +>> SOFTWARE +>> Microsoft +>> Microsoft SQL Server +>> 110 +>> SharedCode + +Right-click on the ...\110\Shared folder; click Properties. On the Security tab, verify that at most the following permissions are present: +Trusted Installer (Full Control) +CREATOR OWNER (Full Control) +System (Full Control) +SQL Server Service SID OR Service Account (Read & Execute) [Notes 1, 2] +System Administrators (Full Control) [Note 3] +Local Administrators (Read) +SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read & Execute) [Notes 1, 2] +SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] +SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Write) [Notes 1, 2] +Users (Read, List Folder Contents, Read & Execute) +[MsDtsServer110 (Read & Execute) is also permitted, if SSIS/DTS is in use.] +[NT AUTHORITY\NETWORK SERVICE (Read & Execute) may also be required for SQL Server Configuration Manager to operate.] + +If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. + +Right-click each folder under the ...\110\Shared folder; click Properties. On the Security tab, verify that at most the permissions listed in the preceding paragraph are present. If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. + +----- + +Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control because these permissions are available only to the specific service when it is running and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.110).aspx. + +Note 2: Tips for adding a service SID/virtual account to a folder's permission list. +1) In Windows Explorer, right-click on the folder and select "Properties." +2) Select the "Security" tab +3) Click "Edit" +4) Click "Add" +5) Click "Locations" +6) Select the computer name +7) Search for the name +7.a) SQL Server Service +7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) +7.a.ii) Select the "MSSQL$<instance name>" user and click "OK" +7.b) SQL Agent Service +7.b.i) Type "NT SERVICE\SQL" and click "Check Names" +7.b.ii) Select the "SQLAgent$<instance name>" user and click "OK" +8) Click "OK" +9) Permission like a normal user from here + +Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only. + +Note 4: Some files also require 'ALL APPLICATION PACKAGES (READ, EXECUTE)' permissions for certain functionality to work appropriately, and this is considered acceptable where those permissions are required. (All SQL Server files that require this access reside by default in the ..\Microsoft SQL Server\110\ directory.) + + + + <VulnDiscussion>Security faults with software applications and operating systems are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. + +Any time new software code is introduced to a system there is the potential for unintended consequences. There have been documented instances where the application of a patch has caused problems with system integrity or availability. Due to information system integrity and availability concerns, organizations must give careful consideration to the methodology used to carry out automatic updates. + +If SQL Server were no longer supported, no patches from Microsoft would address newly discovered security vulnerabilities. Unpatched software is vulnerable to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Check Microsoft's list of supported SQL Server versions. To locate the correct web page, perform a web search for "Microsoft SQL Server end of support." + +To be considered supported, Microsoft must report that the version is supported by security patches to known vulnerabilities. Check SQL Server version by running the following command: print @@version @@ -3922,690 +4320,126 @@ SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any endpoint' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - - - <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any event session' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any event session' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Obtain the list of roles that are authorized for the SQL Server 'Alter any event session' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any event session' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - - - <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter server state' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'Alter server state' permissions are granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Obtain the list of roles that are authorized for the SQL Server 'Alter server state' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. - -Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter server state' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - - - <VulnDiscussion>Backup and recovery of the Service Master Key may be critical to the complete recovery of the database. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Review procedures for, and evidence of backup of, the SQL Server Service Master Key in the System Security Plan. - -If the procedures or evidence do not exist, this is a finding. - -If the procedures do not indicate offline and off-site storage of the Service Master Key, this is a finding. - -If procedures do not indicate access restrictions to the Service Master Key backup, this is a finding. - - - <VulnDiscussion>Separate accounts used to manage the SQL Server platform help prevent a lateral move within an environment if SQL were to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Determine the accounts being used to manage the SQL Server operating system. Determine whether the same accounts are being used to manage other platforms. If the same account is used to manage more than one platform, this is a finding. -Note: If, because of the application configuration, there are multiple instances of SQL that would share a given exploit, a single account would be allowed to be used for the group and would not be considered a finding. - - - - <VulnDiscussion>Database files must be protected from unauthorized access. Although default data locations are created at installation time, sites can, and will, use other directories for site-created database files to comply with best practices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Obtain the SQL Server data directory location(s): in a tool such as SQL Server Management Studio, run the statement: -SELECT DISTINCT -LEFT(physical_name, (LEN(physical_name) - CHARINDEX('\',REVERSE(physical_name)) + 1 )) -AS "Database Data File Paths", -type_desc -FROM sys.master_files -WHERE database_id > 4 -AND type = 0 - -The query result is a list of file systems locations used for databases other than the system databases. Navigate to each of those folder locations using a command prompt or Windows Explorer. The following instructions assume that Windows Explorer is used. - - -Verify that the identified folders and their contents have only authorized privileges. Right-click each folder, click Properties. On the Security tab, verify that at most the following permissions are present: -CREATOR OWNER (Full Control) -System (Full control) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -System Administrators (Full Control) [Note 3] -SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read & Execute) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] -SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Write) [Notes 1, 2] -If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - - - <VulnDiscussion>Use of privileged accounts for non-administrative purposes puts data at risk of unintended or unauthorized loss, modification, or exposure. In particular, DBA accounts, if used for non-administration application development or application maintenance, can lead to excessive privileges where privileges are inherited by object owners. It may also lead to loss or compromise of application data where the elevated privileges bypass controls designed in and provided by applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Review procedures and practices. If there is not a policy requiring owners of privileged accounts to use non-privileged accounts for non-administrative activities, this is a finding. If there is evidence that owners of privileged accounts do not adhere to this policy, this is a finding. - - - <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any event notification' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any event notification' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Obtain the list of roles that are authorized for the SQL Server 'Alter any event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT -who.name AS [Principal Name], -who.type_desc AS [Principal Type], -who.is_disabled AS [Principal Is Disabled], -what.state_desc AS [Permission State], -what.permission_name AS [Permission Name] -FROM -sys.server_permissions what -INNER JOIN sys.server_principals who -ON who.principal_id = what.grantee_principal_id -WHERE -what.permission_name = 'Alter any event notification' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY -who.name -; -GO - - - - - - <VulnDiscussion>SQL Server is capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations, or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled. - -Applications must adhere to the principles of least functionality by providing only essential capabilities. - -Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. Components of the system that are unused and cannot be uninstalled must be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - - Review the components and features included in SQL Server and capable of being disabled (by configuration settings, permissions and privileges, etc.). Take note of those which are enabled. - -Review the system documentation to verify that the enabled components or features are documented and authorized. If any enabled components or features are not authorized, this is a finding. - - - - - - - Creator Owner (Special Permissions - False - - - - - - - - - All Application Packages (Read & Execute) [Only as needed - False - - - - - - - <VulnDiscussion>When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. - -If any user were allowed to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. The DBMS software libraries contain the executables used by the DBMS to operate. Unauthorized access to the libraries can result in compromised installations. This may in turn jeopardize data stored in the DBMS and/or operation of the host system. - -Accordingly, only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. - -Of particular note in this context is that any software installed for auditing and/or audit file management must be protected and monitored.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - - Obtain the SQL Server software directory location: from a command prompt, open the registry editor by typing regedit.exe and pressing [ENTER]. Navigate to the following registry location: -HKEY_LOCAL_MACHINE ->> SOFTWARE ->> Microsoft ->> Microsoft SQL Server ->> [INSTANCE NAME] ->> Setup ->> SQLBinRoot - -In the registry tree, the [INSTANCE NAME] for a SQL Server 2012 database engine instance is normally shown as "MSSQL11" followed by a period and the name that was specified for the SQL Server service at installation time. If multiple SQL Server instances are installed, each will have its own [INSTANCE NAME] node and subtree in the registry. - -The value in the Data column for the SQLBinRoot registry entry is the file system path for the SQL Server 2012 binaries. Navigate to that folder location using a command prompt or Windows Explorer. The following instructions assume that Windows Explorer is used. - -Verify that files and folders that are part of the SQL Server 2012 instance have only authorized privileges. Right-click the binaries (\binn) folder, click Properties. On the Security tab, verify that at most the following permissions are present: -Trusted Installer (Full Control) -CREATOR OWNER (Full Control) -SYSTEM (Full Control) -Administrators (Full Control) [See Note 3] -Users (Read, List Folder Contents, Read & Execute) -Creator Owner (Special Permissions - Full control - Subfolders and files only) -All Application Packages (Read & Execute) [Only as needed - see Note 4] -SQL Server Service SID OR Service Account (Read & Execute) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Full Control) [Notes 1, 2] -SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read & Execute) [Notes 1, 2] -System Administrators (Full Control) [Note 3] - -If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - -Right-click each folder under the binaries folder; click Properties. On the Security tab, verify that at most the permissions listed in the preceding paragraph are present. -If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - -Right-click the \Install folder, which is a peer of \binn, under ...\MSSQL. On the Security tab, verify that at most the permissions listed in the preceding paragraphs are present. If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - - -Locate the ...\Microsoft SQL Server\110\Shared folder, either by stepping up the tree in Windows Explorer or by finding the file path in the registry at: -HKEY_LOCAL_MACHINE ->> SOFTWARE ->> Microsoft ->> Microsoft SQL Server ->> 110 ->> SharedCode - -Right-click on the ...\110\Shared folder; click Properties. On the Security tab, verify that at most the following permissions are present: -Trusted Installer (Full Control) -CREATOR OWNER (Full Control) -System (Full Control) -SQL Server Service SID OR Service Account (Read & Execute) [Notes 1, 2] -System Administrators (Full Control) [Note 3] -Local Administrators (Read) -SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read & Execute) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] -SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Write) [Notes 1, 2] -Users (Read, List Folder Contents, Read & Execute) -[MsDtsServer110 (Read & Execute) is also permitted, if SSIS/DTS is in use.] -[NT AUTHORITY\NETWORK SERVICE (Read & Execute) may also be required for SQL Server Configuration Manager to operate.] - -If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - -Right-click each folder under the ...\110\Shared folder; click Properties. On the Security tab, verify that at most the permissions listed in the preceding paragraph are present. If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - ------ - -Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control because these permissions are available only to the specific service when it is running and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.110).aspx. - -Note 2: Tips for adding a service SID/virtual account to a folder's permission list. -1) In Windows Explorer, right-click on the folder and select "Properties." -2) Select the "Security" tab -3) Click "Edit" -4) Click "Add" -5) Click "Locations" -6) Select the computer name -7) Search for the name -7.a) SQL Server Service -7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) -7.a.ii) Select the "MSSQL$<instance name>" user and click "OK" -7.b) SQL Agent Service -7.b.i) Type "NT SERVICE\SQL" and click "Check Names" -7.b.ii) Select the "SQLAgent$<instance name>" user and click "OK" -8) Click "OK" -9) Permission like a normal user from here - -Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only. - -Note 4: Some files also require 'ALL APPLICATION PACKAGES (READ, EXECUTE)' permissions for certain functionality to work appropriately, and this is considered acceptable where those permissions are required. (All SQL Server files that require this access reside by default in the ..\Microsoft SQL Server\110\ directory.) - - - - - - - - Everyone - - - This folder subfolders and files - Traverse,ExecuteFile,ListDirectory,ReadData,ReadAttributes,ReadExtendedAttributes,CreateFiles,WriteData,CreateDirectories,AppendData,WriteAttributes,WriteExtendedAttributes,Delete,ReadPermissions - - - <VulnDiscussion>Any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. - -Accordingly, only qualified and authorized individuals are allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. - -Access restrictions for change also include software libraries. - -Examples of access restrictions include: physical access controls (such as locks and access cards), logical access controls (such as ACLs), automated auditing (logging) of logical access, workflow automation, media libraries, abstract layers (e.g., changes are implemented into a third-party interface rather than directly into the information system component), and change windows (e.g., changes occur only during specified times, making unauthorized changes outside the window easy to discover). - -This requirement focuses on the auditing aspect of the protections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - True - - - Verify that Files and Folders that are part of the SQL Server 2012 Installation have auditing enabled. - -Right click the root folder of the SQL Server installation. Typically, this is at <drive>:\Program Files\Microsoft SQL Server\. Select Properties. - -Click on the Security tab - -Click on the Advanced button - -Click on the Auditing tab - -If "Everyone" is not listed in the "Name" column, this is a finding. - -If "This folder, subfolders and files" is not listed in the "Apply To" column, this is a finding. - -When "Everyone" ... " is listed, select the "Everyone" row and click on the Edit button. - -If either the Successful or Failed checkbox is not selected for any of the following access types, this is a finding: - Traverse folder/execute file - List folder/read data - Read attributes - Read extended attributes - Create files/write data - Create folders/append data - Write attributes - Write extended attributes - Delete - Read permissions - - - - <VulnDiscussion>SQL Server DBAs, if assigned excessive OS privileges, could perform actions that could endanger the information system or hide evidence of malicious activity. - -This requirement is intended to limit exposure due to operating from within a privileged account or role. The check and fix are based on the assumption that Role-Based Access Control (RBAC) is in effect, as mandated by other STIG requirements. They further assume that, as mandated elsewhere, the privileged accounts discussed here are distinct from the accounts used by the same people when not performing privileged functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-40937 - True - False - False - - - From the system security documentation, obtain the list of SQL Server DBA accounts, the OS/domain Group(s) representing those DBAs' job role(s), and the OS permissions required by that/those role(s). - - -To review local accounts and groups: - -Log on to the Windows server hosting SQL Server, using an account with administrator privileges. - -From a command prompt opened as administrator, type gpedit.msc, and press [ENTER]. In Group Policy Editor, navigate to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment. Scan the list to determine which privileges are assigned to the Group(s) representing the SQL Server DBA job role(s). If any privileges are assigned that are not required by these roles, this is a finding. - -From the command prompt, type lusrmgr.msc, and press [ENTER]. In the Local Users and Groups console, navigate to Users. Right-click each DBA user. Click Properties. Click the 'Member of' tab. If any parent groups are listed that are not specific to DBA roles, this is a finding. - -In the Local Users and Groups console, navigate to Groups. Right-click each DBA Group. Click Properties. Review the list of group members. If any account that does not represent a DBA is listed, this is a finding. - - -To review domain-level accounts and groups: - -Log on to a domain controller with the necessary privileges. - -Open Active Directory Users and Computers (available from menus or run dsa.msc) - -Determine the location of the accounts or groups to be reviewed. The default is the Users container, but they could have been created or moved to an Organizational Unit (OU) that is domain specific. - -Right-click each DBA user. Click Properties. Click the 'Member of' tab. If any parent groups are listed that are not specific to DBA roles, this is a finding. - -Right-click each DBA Group. Click Properties. Select the 'Members' tab. Review the list of group members. If any account that does not represent a DBA is listed, this is a finding. - - - - <VulnDiscussion>This requirement is intended to limit exposure due to operating from within a privileged account or role. The inclusion of role is intended to address those situations where an access control policy, such as Role-Based Access Control (RBAC), is being implemented and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account. - -Audit of privileged activity may require physical separation, employing information systems on which the user does not have privileged access. - -To limit exposure and provide forensic history of activity when operating from within a privileged account or role, SQL Server does support organizational requirements that users of information system accounts, or roles, with access to an organization-defined list of security functions or security-relevant information, use non-privileged accounts, or roles, when accessing other (non-security) system functions. - -SQL Server provides access logging that ensures users who are granted a privileged role (or roles) have their privileged activity logged. DBAs, if assigned excessive privileges, could perform actions that endanger the information system or hide evidence of malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-40937 - True - False - False - - - Obtain the list of all DBAs. -Obtain documented role assignments for each DBA. -Obtain from system documentation or use SQL Server to determine privilege assignment of user-defined roles. - -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Logins >> right click <'administrator account name'> >> Properties >> User >> Securables. - -If any item in the 'Permission' listing, for each highlighted item that exists in the 'Securables' listing, has excessive privileges, this is a finding. - -Navigate from 'Securables' to 'Server Roles'. - -If any checked 'Server roles' are determined to be excessive privileges, this is a finding. - -Navigate from 'Server Roles' to 'Users mapped to the login'. - -If any checked 'Database role membership' of each highlighted and checked 'Database' are determined to be excessive privileges, this is a finding. - - - - <VulnDiscussion>The principle of Least Privilege must be applied to the ability of users to access system tables, system management information, other configuration information, and metadata. Unauthorized access to this data could result in unauthorized changes to database objects, access controls, or SQL Server configuration. Only database administrators and other authorized users must be allowed such access. - -To aid in tracking and administering such permissions, individual logins must not be directly granted permissions or built-in server roles. Instead, user-defined server roles must be created, with the permissions and built-in server roles granted to them; the individual logins must be assigned to the appropriate user-defined server roles. - -The built-in server role "sysadmin" is a partial exception. This cannot be granted to a user-defined role, only to a login account. Most (not necessarily all) database administrators will need to be members of sysadmin. Without this, most DBCC commands and the system stored procedures/functions listed below are unavailable. The users who require such access must be documented and approved. - -In addition, if the site uses backup-restore software that connects to SQL Server via the Virtual Device Interface (VDI), the account used by that software must have the sysadmin role. (See Microsoft Knowledge Base article 2926557, http://support.microsoft.com/kb/2926557). If this applies, it must be documented and approved. - -Stored procedures/functions available only to the sysadmin role: -fn_yukonsecuritymodelrequired -sp_add_agent_parameter -sp_add_agent_profile -sp_adddatatype -sp_adddistributiondb -sp_adddistributor -sp_addqreader_agent -sp_addsubscriber -sp_addsubscriber_schedule -sp_addtabletocontents -sp_attachsubscription -sp_cdc_cleanup_change_table -sp_cdc_disable_db -sp_cdc_disable_table -sp_cdc_drop_job -sp_cdc_enable_db -sp_cdc_enable_table -sp_cdc_restoredb -sp_cdc_vupgrade -sp_certify_removable -sp_change_agent_parameter -sp_change_agent_profile -sp_change_subscription_properties -sp_change_users_login -sp_changedistpublisher -sp_changedistributiondb -sp_changedistributor_password -sp_changedistributor_property -sp_changemergesubscription -sp_changeqreader_agent -sp_changereplicationserverpasswords -sp_changesubscriptiondtsinfo -sp_checkinvalidivarticle -sp_copysubscription -sp_create_removable -sp_cycle_errorlog -sp_dbcmptlevel -sp_dbmmonitoraddmonitoring -sp_dbmmonitorchangealert -sp_dbmmonitordropalert -sp_dbmmonitordropmonitoring -sp_dbmmonitorhelpalert -sp_dbmmonitorhelpmonitoring -sp_dbmmonitorresults -sp_dbmmonitorupdate -sp_dbremove -sp_drop_agent_parameter -sp_drop_agent_profile -sp_dropdatatypemapping -sp_dropdistpublisher -sp_dropdistributiondb -sp_dropdistributor -sp_dropmergepullsubscription -sp_droppullsubscription -sp_dropsubscriber -sp_dsninfo -sp_enumdsn -sp_flush_commit_table_on_demand -sp_generate_agent_parameter -sp_get_distributor -sp_get_Oracle_publisher_metadata -sp_getagentparameterlist -sp_getdefaultdatatypemapping -sp_grant_publication_access -sp_help_agent_default -sp_help_agent_parameter -sp_help_agent_profile -sp_helpdistpublisher -sp_helpdistributor -sp_helpmergesubscription -sp_helpqreader_agent -sp_helpreplicationdboption -sp_identitycolumnforreplication -sp_IHValidateRowFilter -sp_IHXactSetJob -sp_link_publication -sp_monitor -sp_MSadd_distribution_agent -sp_MSadd_logreader_agent -sp_MSadd_merge_agent -sp_MSadd_snapshot_agent -sp_MSadd_subscriber_schedule -sp_MSadd_tracer_history -sp_MSadd_tracer_token -sp_MScdc_cleanup_job -sp_MScdc_db_ddl_event -sp_MScdc_ddl_event -sp_MSchange_distribution_agent_properties -sp_MSchange_logreader_agent_properties -sp_MSchange_merge_agent_properties -sp_MSchange_snapshot_agent_properties -sp_MSchangedynamicsnapshotjobatdistributor -sp_MSchangedynsnaplocationatdistributor -sp_MScheck_pull_access -sp_MScleanupmergepublisher_internal -sp_MSclear_dynamic_snapshot_location -sp_MScreate_dist_tables -sp_MSdbuserpriv -sp_MSdeletefoldercontents -sp_MSdrop_6x_replication_agent -sp_MSdrop_merge_agent -sp_MSdrop_snapshot_dirs -sp_MSdropmergedynamicsnapshotjob -sp_MSdynamicsnapshotjobexistsatdistributor -sp_MSenumallpublications -sp_MSfetchAdjustidentityrange -sp_MSfix_6x_tasks -sp_MSforce_drop_distribution_jobs -sp_MSget_agent_names -sp_MSget_jobstate -sp_MSget_oledbinfo -sp_MSget_publication_from_taskname -sp_MSgetdbversion -sp_MSgetmaxsnapshottimestamp -sp_MShelp_repl_agent -sp_MShelp_replication_status -sp_MShelp_snapshot_agent -sp_MShelpconflictpublications -sp_MShelpdynamicsnapshotjobatdistributor -sp_MShelplogreader_agent -sp_MShelpsnapshot_agent -sp_MShelptranconflictcounts -sp_MSinit_publication_access -sp_MSreinit_failed_subscriptions -sp_MSremoveoffloadparameter -sp_MSrepl_backup_complete -sp_MSrepl_backup_start -sp_MSrepl_createdatatypemappings -sp_MSrepl_dropdatatypemappings -sp_MSrepl_enumarticlecolumninfo -sp_MSrepl_enumpublications -sp_MSrepl_enumpublishertables -sp_MSrepl_enumsubscriptions -sp_MSrepl_enumtablecolumninfo -sp_MSrepl_getdistributorinfo -sp_MSrepl_startup_internal -sp_MSreplagentjobexists -sp_MSreplcheck_permission -sp_MSreplcheck_pull -sp_MSreplcheck_subscribe -sp_MSreplcheck_subscribe_withddladmin -sp_MSreplcopyscriptfile -sp_MSreplremoveuncdir -sp_MSsetalertinfo -sp_MSSetServerProperties -sp_MSsetupnosyncsubwithlsnatdist -sp_MSsetupnosyncsubwithlsnatdist_cleanup -sp_MSsetupnosyncsubwithlsnatdist_helper -sp_MSstartdistribution_agent -sp_MSstartmerge_agent -sp_MSstartsnapshot_agent -sp_MSstopdistribution_agent -sp_MSstopmerge_agent -sp_MSstopsnapshot_agent -sp_MSupdate_agenttype_default -sp_oledbinfo -sp_procoption -sp_removedbreplication -sp_removesrvreplication -sp_replication_agent_checkup -sp_replicationdboption -sp_resetstatus -sp_restoredbreplication -sp_SetAutoSAPasswordAndDisable -sp_setdefaultdatatypemapping -sp_updatestats -sp_validatelogins -sp_vupgrade_mergeobjects -sp_vupgrade_replication -sp_vupgrade_replsecurity_metadata -xp_repl_convert_encrypt_sysadmin_wrapper -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-40937 - True + what.state_desc AS [Permission State], + what.permission_name AS [Permission Name] +FROM + sys.server_permissions what + INNER JOIN sys.server_principals who + ON who.principal_id = what.grantee_principal_id +WHERE + what.permission_name = 'Alter any endpoint' +AND who.type_desc = 'SERVER_ROLE' +ORDER BY + who.name +; +GO + +If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. + + + <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. + +Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. + +SQL Server's 'Alter any event session' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any event session' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. + +Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. + +The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + False False - - Use SQL Server and system documentation to determine privilege assignment of user-defined roles. + Obtain the list of roles that are authorized for the SQL Server 'Alter any event session' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -Determine which user-defined roles grant privileges to system tables and configuration data stored in SQL Server. +SELECT + who.name AS [Principal Name], + who.type_desc AS [Principal Type], + who.is_disabled AS [Principal Is Disabled], + what.state_desc AS [Permission State], + what.permission_name AS [Permission Name] +FROM + sys.server_permissions what + INNER JOIN sys.server_principals who + ON who.principal_id = what.grantee_principal_id +WHERE + what.permission_name = 'Alter any event session' +AND who.type_desc = 'SERVER_ROLE' +ORDER BY + who.name +; +GO -For each Login: +If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. + + + <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. -In SQL Server Management Studio, Object Explorer, expand <SQL Server instance> >> Security >> Logins >> Right-click <login account name> >> Properties >> User >> Securables. +Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. -If any item in the Explicit Permissions listing, for each highlighted item that exists in the Securables listing, indicates direct permission access, and that permission is anything other than Connect SQL, this is a finding. +SQL Server's 'Alter server state' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'Alter server state' permissions are granted to roles that are unauthorized to have this privilege, then this access must be removed. -Navigate from Securables to Server Roles. +Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. -If any Server Roles are checked from the following list, indicating direct permission access, this is a finding: -bulkadmin -dbcreator -diskadmin -processadmin -securityadmin -serveradmin -setupadmin +The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain the list of roles that are authorized for the SQL Server 'Alter server state' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. -If the sysadmin server role is checked, review system documentation to determine whether this login's need for the sysadmin role is documented and approved. If it is not, this is a finding. +Obtain the list of roles with that permission by running the following query: -If any user-defined server roles with system table or configuration data privileges are checked, review system documentation to determine whether this login's need for the role is documented and approved. If it is not, this is a finding. +SELECT + who.name AS [Principal Name], + who.type_desc AS [Principal Type], + who.is_disabled AS [Principal Is Disabled], + what.state_desc AS [Permission State], + what.permission_name AS [Permission Name] +FROM + sys.server_permissions what + INNER JOIN sys.server_principals who + ON who.principal_id = what.grantee_principal_id +WHERE + what.permission_name = 'Alter server state' +AND who.type_desc = 'SERVER_ROLE' +ORDER BY + who.name +; +GO -Navigate from Server Roles to User Mapping. Select in turn each entry where the User column is non-blank. If any Database Roles are checked from the following list, indicating direct permission access, this is a finding: -db_accessadmin -db_backupoperator -db_datareader -db_datawriter -db_ddladmin -db_denydatareader -db_denydatawriter -db_owner -db_securityadmin +If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. + + + <VulnDiscussion>Backup and recovery of the Service Master Key may be critical to the complete recovery of the database. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review procedures for, and evidence of backup of, the SQL Server Service Master Key in the System Security Plan. + +If the procedures or evidence do not exist, this is a finding. + +If the procedures do not indicate offline and off-site storage of the Service Master Key, this is a finding. + +If procedures do not indicate access restrictions to the Service Master Key backup, this is a finding. + + + <VulnDiscussion>Separate accounts used to manage the SQL Server platform help prevent a lateral move within an environment if SQL were to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine the accounts being used to manage the SQL Server operating system. Determine whether the same accounts are being used to manage other platforms. If the same account is used to manage more than one platform, this is a finding. +Note: If, because of the application configuration, there are multiple instances of SQL that would share a given exploit, a single account would be allowed to be used for the group and would not be considered a finding. + - - + <VulnDiscussion>Default database file locations should be protected from unauthorized access. The system databases, essential to SQL Server operation, are typically located here.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-40937 - True + False False - Obtain the SQL Server default data directory location: from a command prompt, open the registry editor by typing regedit.exe, and pressing [ENTER]. Navigate to the following registry location: HKEY_LOCAL_MACHINE >> SOFTWARE @@ -4661,15 +4495,40 @@ Note 3: In the interest of separation of responsibilities with least privilege, Note 4: It may also be necessary to grant the SQL Server Agent permission to Delete the \Log directory and its contents. This is not a finding. - - + + <VulnDiscussion>Database files must be protected from unauthorized access. Although default data locations are created at installation time, sites can, and will, use other directories for site-created database files to comply with best practices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain the SQL Server data directory location(s): in a tool such as SQL Server Management Studio, run the statement: +SELECT DISTINCT +LEFT(physical_name, (LEN(physical_name) - CHARINDEX('\',REVERSE(physical_name)) + 1 )) +AS "Database Data File Paths", +type_desc +FROM sys.master_files +WHERE database_id > 4 +AND type = 0 + +The query result is a list of file systems locations used for databases other than the system databases. Navigate to each of those folder locations using a command prompt or Windows Explorer. The following instructions assume that Windows Explorer is used. + + +Verify that the identified folders and their contents have only authorized privileges. Right-click each folder, click Properties. On the Security tab, verify that at most the following permissions are present: +CREATOR OWNER (Full Control) +System (Full control) +SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] +System Administrators (Full Control) [Note 3] +SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read & Execute) [Notes 1, 2] +SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] +SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Write) [Notes 1, 2] +If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. + + <VulnDiscussion>Backups must be protected from unauthorized deletion and modification. They must also be protected from unauthorized use in database restoration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-40937 - True + False False - Obtain the SQL Server backup directory location: from a command prompt, open the registry editor by typing regedit.exe, and pressing [ENTER]. Navigate to the following registry location: HKEY_LOCAL_MACHINE >> SOFTWARE @@ -4721,7 +4580,107 @@ Note 2: Tips for adding a service SID/virtual account to a folder's permission l Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only. - + + <VulnDiscussion>Use of privileged accounts for non-administrative purposes puts data at risk of unintended or unauthorized loss, modification, or exposure. In particular, DBA accounts, if used for non-administration application development or application maintenance, can lead to excessive privileges where privileges are inherited by object owners. It may also lead to loss or compromise of application data where the elevated privileges bypass controls designed in and provided by applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review procedures and practices. If there is not a policy requiring owners of privileged accounts to use non-privileged accounts for non-administrative activities, this is a finding. If there is evidence that owners of privileged accounts do not adhere to this policy, this is a finding. + + + <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. + +Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. + +SQL Server's 'Alter any event notification' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any event notification' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. + +Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. + +The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain the list of roles that are authorized for the SQL Server 'Alter any event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: + +SELECT +who.name AS [Principal Name], +who.type_desc AS [Principal Type], +who.is_disabled AS [Principal Is Disabled], +what.state_desc AS [Permission State], +what.permission_name AS [Permission Name] +FROM +sys.server_permissions what +INNER JOIN sys.server_principals who +ON who.principal_id = what.grantee_principal_id +WHERE +what.permission_name = 'Alter any event notification' +AND who.type_desc = 'SERVER_ROLE' +ORDER BY +who.name +; +GO + + + + + + + + + Everyone + + + This folder subfolders and files + Traverse,ExecuteFile,ListDirectory,ReadData,ReadAttributes,ReadExtendedAttributes,CreateFiles,WriteData,CreateDirectories,AppendData,WriteAttributes,WriteExtendedAttributes,Delete,ReadPermissions + + + <VulnDiscussion>Any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. + +Accordingly, only qualified and authorized individuals are allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. + +Access restrictions for change also include software libraries. + +Examples of access restrictions include: physical access controls (such as locks and access cards), logical access controls (such as ACLs), automated auditing (logging) of logical access, workflow automation, media libraries, abstract layers (e.g., changes are implemented into a third-party interface rather than directly into the information system component), and change windows (e.g., changes occur only during specified times, making unauthorized changes outside the window easy to discover). + +This requirement focuses on the auditing aspect of the protections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + True + the correct path is specified and does NOT conflict with RuleId V-69169 + + + Verify that Files and Folders that are part of the SQL Server 2012 Installation have auditing enabled. + +Right click the root folder of the SQL Server installation. Typically, this is at <drive>:\Program Files\Microsoft SQL Server\. Select Properties. + +Click on the Security tab + +Click on the Advanced button + +Click on the Auditing tab + +If "Everyone" is not listed in the "Name" column, this is a finding. + +If "This folder, subfolders and files" is not listed in the "Apply To" column, this is a finding. + +When "Everyone" ... " is listed, select the "Everyone" row and click on the Edit button. + +If either the Successful or Failed checkbox is not selected for any of the following access types, this is a finding: + Traverse folder/execute file + List folder/read data + Read attributes + Read extended attributes + Create files/write data + Create folders/append data + Write attributes + Write extended attributes + Delete + Read permissions + + @@ -4738,12 +4697,13 @@ Note 3: In the interest of separation of responsibilities with least privilege, Unmanaged changes that occur to the software libraries or configuration can lead to unauthorized or compromised installations. Of particular note in this context is that any software installed for auditing and/or audit file management must be protected and audited.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-40950 + False False True - - + the correct path is specified and does NOT conflict with RuleId V-40950 + + Obtain the SQL Server software directory location: from a command prompt, open the registry editor by typing regedit.exe and pressing [ENTER]. Navigate to the following registry location: HKEY_LOCAL_MACHINE >> SOFTWARE diff --git a/StigData/Processed/SqlServer-2012-Instance-1.19.org.default.xml b/StigData/Processed/SqlServer-2012-Instance-1.19.org.default.xml index 31be6d81c..a37332a7d 100644 --- a/StigData/Processed/SqlServer-2012-Instance-1.19.org.default.xml +++ b/StigData/Processed/SqlServer-2012-Instance-1.19.org.default.xml @@ -6,7 +6,7 @@ associated comment. --> - + @@ -16,6 +16,6 @@ - + diff --git a/StigData/Processed/SqlServer-2012-Instance-1.19.xml b/StigData/Processed/SqlServer-2012-Instance-1.19.xml index 87f62091a..a6466d141 100644 --- a/StigData/Processed/SqlServer-2012-Instance-1.19.xml +++ b/StigData/Processed/SqlServer-2012-Instance-1.19.xml @@ -1,7 +1,7 @@ - + - <VulnDiscussion>Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS), VPN, or IPSEC tunnel. + <VulnDiscussion>Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS), VPN, or IPSEC tunnel. Information in transmission is particularly vulnerable to attack. If the DBMS does not employ cryptographic mechanisms preventing unauthorized disclosure of information during transit, the information may be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -43,7 +43,7 @@ Load balancing for the purpose of sharing a secondary/backup SQL Server is often If Database Availability Groups are not being used, this is not applicable (NA). -Check the system documentation and check with the administrator regarding processing resources of the backup/secondary SQL Server. +Check the system documentation and check with the administrator regarding processing resources of the backup/secondary SQL Server. If the primary SQL Server has a backup/secondary server that is dedicated 100% to the primary server's processing, this is not a finding. @@ -66,11 +66,11 @@ Even if SQL Server's utilization is very small and there may seem to be no need If SQL Server has users that are determined to run significantly high priority processes than other users and the SQL Server "Resource Governor" is not being implemented, this is a finding. - <VulnDiscussion>When data is exchanged between information systems, the security attributes associated with said data need to be maintained. + <VulnDiscussion>When data is exchanged between information systems, the security attributes associated with said data need to be maintained. -Security attributes are an abstraction representing the basic properties or characteristics of an entity with respect to safeguarding information, typically associated with internal data structures (e.g., records, buffers, files) within the information system and used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy. +Security attributes are an abstraction representing the basic properties or characteristics of an entity with respect to safeguarding information, typically associated with internal data structures (e.g., records, buffers, files) within the information system and used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy. -Security attributes may be explicitly or implicitly associated with the information contained within the information system. +Security attributes may be explicitly or implicitly associated with the information contained within the information system. If database security labels are not maintained as information moves between systems, handling instructions can be lost and data can be accidentally distributed to unauthorized individuals.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -81,7 +81,7 @@ If database security labels are not maintained as information moves between syst If the labeling of sensitive data is not required, this is NA. -Obtain system configuration setting to determine how data labeling is being performed. This can be through triggers or some other SQL developed means or via a third-party tool. Check to ensure that labels are being associated to data when information is being exchanged between systems. +Obtain system configuration setting to determine how data labeling is being performed. This can be through triggers or some other SQL developed means or via a third-party tool. Check to ensure that labels are being associated to data when information is being exchanged between systems. If the labeling is not being associated to data when exchanging data between systems, this is a finding. @@ -156,7 +156,7 @@ This requirement is not intended to prevent the establishment of public-facing s If SQL Server supports an application collecting information from the public, this is NA. Obtain from the DBA or system documentation the list of publicly available data within SQL Server. -Obtain the publicly available user account(s) being used to access SQL Server. +Obtain the publicly available user account(s) being used to access SQL Server. Determine if SQL Server is granting more than read access to the publicly available information through SQL Server 'Securables'. @@ -261,7 +261,7 @@ Detailed information on the NIST Cryptographic Module Validation Program (CMVP) Non-organizational users shall be uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization when related to the use of anonymous access, such as accessing a web server. -This may be accomplished by a code embedded within the userid, or via a flag or code columns in a table of users, or by some other means. In any case, the user must be individually identified to, and within, SQL Server via a mapping to an individual account and not mapping to a shared account. +This may be accomplished by a code embedded within the userid, or via a flag or code columns in a table of users, or by some other means. In any case, the user must be individually identified to, and within, SQL Server via a mapping to an individual account and not mapping to a shared account. Accordingly, a risk assessment is used in determining the authentication needs of the organization. @@ -345,11 +345,27 @@ Evidence of implementation includes records of backup events and physical review Evidence should match the backup plan as recorded in the system documentation. If backup procedures do not exist or are not implemented in accordance with the procedures, this is a finding. + + + <VulnDiscussion>SQL Server is capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations, or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. Components of the system that are unused and cannot be uninstalled must be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the components and features included in SQL Server and capable of being disabled (by configuration settings, permissions and privileges, etc.). Take note of those which are enabled. + +Review the system documentation to verify that the enabled components or features are documented and authorized. If any enabled components or features are not authorized, this is a finding. - <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled. +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled. Applications must adhere to the principles of least functionality by providing only essential capabilities. @@ -427,7 +443,7 @@ Unmanaged changes that occur to SQL Server software libraries or configuration c Verify within the system documentation that SQL Server is monitoring for security-relevant configuration settings to discover unauthorized changes. -This can be done by a third-party tool or a SQL script that does baselining and then comparisons. +This can be done by a third-party tool or a SQL script that does baselining and then comparisons. If the monitoring of security-relevant configuration settings to discover unauthorized changes is not implemented on SQL Server, this is a finding. @@ -447,9 +463,9 @@ When shared accounts are utilized without another means of identifying individua Obtain the list of authorized SQL Server accounts in the system documentation. -If accounts are determined to be shared, determine if individuals are first individually authenticated. If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. (The key is individual accountability. If this can be traced, this is not a finding.) +If accounts are determined to be shared, determine if individuals are first individually authenticated. If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. (The key is individual accountability. If this can be traced, this is not a finding.) -If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding. +If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding. Review contents of audit logs, traces and data tables to confirm that the identity of the individual user performing the action is captured. If shared identifiers are found, and not accompanied by individual identifiers, this is a finding. @@ -469,250 +485,301 @@ The SQL Server installation account requires privileges not required for SQL Ser If the account is used for anything beyond SQL Server installation, upgrade, and maintenance actions, this is a finding. - - <VulnDiscussion>Applications employ the concept of least privilege for specific duties and information systems (including specific functions, ports, protocols, and services). The concept of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of information systems. + + <VulnDiscussion>SQL Server DBAs, if assigned excessive OS privileges, could perform actions that could endanger the information system or hide evidence of malicious activity. -Unauthorized access to sensitive data may compromise the confidentiality of personnel privacy, threaten national security or compromise a variety of other sensitive operations. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +This requirement is intended to limit exposure due to operating from within a privileged account or role. The check and fix are based on the assumption that Role-Based Access Control (RBAC) is in effect, as mandated by other STIG requirements. They further assume that, as mandated elsewhere, the privileged accounts discussed here are distinct from the accounts used by the same people when not performing privileged functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False - Obtain the list of available user-defined server roles from system documentation. - -Obtain the list of available user-defined server roles from the SQL Server system by running the following script: -/********************************************************************************** - LIST ALL INDIRECT (via ROLES) ACCESS TO THE SERVER PERMISSION. - ***********************************************************************************/ -DECLARE @admin_Account_name sysname -SET @admin_Account_name = 'NO admin ACCOUNT found' -DECLARE @server_name sysname -SET @server_name = 'NO Server found' - -SELECT @server_name = name FROM sys.servers - WHERE server_id = 0 -SET @admin_Account_name = @server_name + '\Administrator' - -SELECT pe.grantee_principal_id - , pr.type AS 'Grantee_Type' - , pr.name AS 'Grantee_Name' - , pe.type - , pe.permission_name - , pe.state - , pe.state_desc - FROM sys.server_permissions pe - JOIN sys.server_principals pr - ON pe.grantee_principal_id = pr.principal_id - JOIN sys.server_principals ps - ON pe.grantor_principal_id = ps.principal_id - LEFT JOIN sys.server_principals us - ON us.principal_id = pe.major_id - WHERE pr.type IN ('R') - AND pe.grantee_principal_id > 10 - AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', - 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', - 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') - AND NOT pr.name = @admin_Account_name - ORDER BY CASE pe.state - WHEN 'D' THEN 1 - WHEN 'W' THEN 2 - WHEN 'G' THEN 3 - ELSE 4 - END - -If any listed user-defined roles are not found in the system documentation, this is a finding. - -Obtain the list assigned privileges for all user-defined roles in the system documentation. - -Check all SQL Server user-defined server roles for access rights as it relates to the separation of duties. Repeat steps for each user-defined server role. -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Server Roles >> right click <'user-defined server role name'> >> Properties >> General >> Securables. If any user-defined role is assigned privileges that are not documented in the system documentation, this is a finding. - -If any user-defined role contains permissions that are inconsistent with separation sensitive information assignment, this is a finding. + From the system security documentation, obtain the list of SQL Server DBA accounts, the OS/domain Group(s) representing those DBAs' job role(s), and the OS permissions required by that/those role(s). -If system access requires more than one level of sensitive information access and the user-defined role names do not clearly differentiate between the different levels of sensitive information, this is a finding. - - - <VulnDiscussion>Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action. -Additionally, the person or entity accountable for monitoring the activity must be separate as well. To meet this requirement, applications, when applicable, shall be divided where functionality is based on roles and duties. Examples of separation of duties include: (i) mission functions and distinct information system support functions are divided among different individuals/roles; (ii) different individuals perform information system support functions (e.g., system management, systems programming, configuration management, quality assurance and testing, network security); (iii) security personnel who administer access control functions do not administer audit functions; and (iv) different administrator accounts for different roles. +To review local accounts and groups: -Privileges granted outside the role of the application user job function are more likely to go unmanaged or without oversight for authorization. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Check for direct user assignment to server permissions by running the following script: -/********************************************************************************** - LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT - SYSTEM ADMINISTRATOR accounts. DO NOT LIST ROLES. -***********************************************************************************/ -DECLARE @admin_Account_name sysname -SET @admin_Account_name = 'NO administrator account found' -DECLARE @server_name sysname -SET @server_name = 'NO Server found' +Log on to the Windows server hosting SQL Server, using an account with administrator privileges. -SELECT @server_name = name FROM sys.servers - WHERE server_id = 0 -SET @admin_Account_name = @server_name + '\Administrator' +From a command prompt opened as administrator, type gpedit.msc, and press [ENTER]. In Group Policy Editor, navigate to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment. Scan the list to determine which privileges are assigned to the Group(s) representing the SQL Server DBA job role(s). If any privileges are assigned that are not required by these roles, this is a finding. -SELECT pe.grantee_principal_id - , pr.type AS 'Grantee_Type' - , pr.name AS 'Grantee_Name' - , pe.type - , pe.permission_name - , pe.state - , pe.state_desc - FROM sys.server_permissions pe - JOIN sys.server_principals pr - ON pe.grantee_principal_id = pr.principal_id - JOIN sys.server_principals ps - ON pe.grantor_principal_id = ps.principal_id - LEFT JOIN sys.server_principals us - ON us.principal_id = pe.major_id - WHERE pr.type IN ('K', 'S', 'U') - AND pe.grantee_principal_id > 10 - AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', - 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', - 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') - AND NOT pr.name = @admin_Account_name - AND NOT pe.permission_name = 'connect sql' - ORDER BY CASE pr.type - WHEN 'K' THEN 1 - WHEN 'S' THEN 2 - WHEN 'U' THEN 3 - ELSE 4 - END +From the command prompt, type lusrmgr.msc, and press [ENTER]. In the Local Users and Groups console, navigate to Users. Right-click each DBA user. Click Properties. Click the 'Member of' tab. If any parent groups are listed that are not specific to DBA roles, this is a finding. -If any user account list indicates direct access to any server permission, this is a finding. +In the Local Users and Groups console, navigate to Groups. Right-click each DBA Group. Click Properties. Review the list of group members. If any account that does not represent a DBA is listed, this is a finding. -Obtain the list of available user-defined server roles from system documentation. -Obtain the list of available user-defined server roles from the SQL Server system by running the following script: -/********************************************************************************** - LIST ALL INDIRECT (via ROLES) ACCESS TO THE SERVER PERMISSION. - ***********************************************************************************/ -DECLARE @admin_Account_name sysname -SET @admin_Account_name = 'NO admin ACCOUNT found' -DECLARE @server_name sysname -SET @server_name = 'NO Server found' +To review domain-level accounts and groups: -SELECT @server_name = name FROM sys.servers - WHERE server_id = 0 -SET @admin_Account_name = @server_name + '\Administrator' +Log on to a domain controller with the necessary privileges. -SELECT pe.grantee_principal_id - , pr.type AS 'Grantee_Type' - , pr.name AS 'Grantee_Name' - , pe.type - , pe.permission_name - , pe.state - , pe.state_desc - FROM sys.server_permissions pe - JOIN sys.server_principals pr - ON pe.grantee_principal_id = pr.principal_id - JOIN sys.server_principals ps - ON pe.grantor_principal_id = ps.principal_id - LEFT JOIN sys.server_principals us - ON us.principal_id = pe.major_id - WHERE pr.type IN ('R') - AND pe.grantee_principal_id > 10 - AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', - 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', - 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') - AND NOT pr.name = @admin_Account_name - AND NOT pe.permission_name = 'connect sql' - ORDER BY CASE pe.state - WHEN 'D' THEN 1 - WHEN 'W' THEN 2 - WHEN 'G' THEN 3 - ELSE 4 - END +Open Active Directory Users and Computers (available from menus or run dsa.msc) -If any listed user-defined roles are not found in the system documentation, this is a finding. +Determine the location of the accounts or groups to be reviewed. The default is the Users container, but they could have been created or moved to an Organizational Unit (OU) that is domain specific. -Obtain the list of assigned privileges for all user-defined roles in the system documentation. +Right-click each DBA user. Click Properties. Click the 'Member of' tab. If any parent groups are listed that are not specific to DBA roles, this is a finding. -Check all SQL Server user-defined server roles for access rights as it relates to the separation of duties. Repeat steps for each user-defined server role. -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Server Roles >> right click <'user-defined server role name'> >> Properties >> General >> Securables. If any roles are found that do not enforce separation of duties, this is a finding. +Right-click each DBA Group. Click Properties. Select the 'Members' tab. Review the list of group members. If any account that does not represent a DBA is listed, this is a finding. - - <VulnDiscussion>Discretionary Access Control (DAC) is based on the premise that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). + + <VulnDiscussion>This requirement is intended to limit exposure due to operating from within a privileged account or role. The inclusion of role is intended to address those situations where an access control policy, such as Role-Based Access Control (RBAC), is being implemented and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account. -These DAC concepts extend to the server level. Server instances have the potential for the access controls to propagate without limit, resulting in unauthorized access. +Audit of privileged activity may require physical separation, employing information systems on which the user does not have privileged access. -The DBMS must ensure the recipient of server permissions possesses only the access intended. The DBMS must enforce the ability to limit unauthorized rights propagation. If propagation is not prevented, users can continue to grant rights to other users without limit.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +To limit exposure and provide forensic history of activity when operating from within a privileged account or role, SQL Server does support organizational requirements that users of information system accounts, or roles, with access to an organization-defined list of security functions or security-relevant information, use non-privileged accounts, or roles, when accessing other (non-security) system functions. + +SQL Server provides access logging that ensures users who are granted a privileged role (or roles) have their privileged activity logged. DBAs, if assigned excessive privileges, could perform actions that endanger the information system or hide evidence of malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False - Check for rights propagation assignment to DBMS server permissions by running the following query: - -USE master; -SELECT * -FROM sys.server_permissions -WHERE state_desc = 'GRANT_WITH_GRANT_OPTION'; + Obtain the list of all DBAs. +Obtain documented role assignments for each DBA. +Obtain from system documentation or use SQL Server to determine privilege assignment of user-defined roles. -If any of the permissions listed have not been documented and approved as requiring GRANT_WITH_GRANT_OPTION, this is a finding. - - - <VulnDiscussion>Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) are employed by organizations to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, domains). +Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Logins >> right click <'administrator account name'> >> Properties >> User >> Securables. -DAC is a type of access control methodology serving as a means of restricting access to objects and data based on the identity of subjects and/or groups to which they belong. It is discretionary in the sense that application users with the appropriate permissions to access an application resource or data have the discretion to pass that permission on to another user either directly or indirectly. +If any item in the 'Permission' listing, for each highlighted item that exists in the 'Securables' listing, has excessive privileges, this is a finding. -Data protection requirements may result in a DAC policy being specified as part of the application design. Discretionary access controls would be employed at the application level to restrict and control access to application objects and data, thereby providing increased information security for the organization. +Navigate from 'Securables' to 'Server Roles'. -When DAC controls are employed, those controls must limit sharing to named application users, groups of users, or both. The application DAC controls must also limit the propagation of access rights and have the ability to exclude access to data down to the granularity of a single user. +If any checked 'Server roles' are determined to be excessive privileges, this is a finding. -Databases using DAC must have the ability for the owner of an object or information to assign or revoke rights to view or modify the object or information. If the owner of an object or information does not have rights to exclude access to an object or information at a user level, users may gain access to objects and information they are not authorized to view/modify.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Check for direct user assignment to server permissions by running the following script: -/********************************************************************************** - LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT - SYSTEM ADMINISTRATOR accounts. DO NOT LIST ROLES. -***********************************************************************************/ -DECLARE @admin_Account_name sysname -SET @admin_Account_name = 'NO Administrator account found' -DECLARE @server_name sysname -SET @server_name = 'NO Server found' +Navigate from 'Server Roles' to 'Users mapped to the login'. -SELECT @server_name = name FROM sys.servers - WHERE server_id = 0 -SET @admin_Account_name = @server_name + '\Administrator' +If any checked 'Database role membership' of each highlighted and checked 'Database' are determined to be excessive privileges, this is a finding. + + + <VulnDiscussion>The principle of Least Privilege must be applied to the ability of users to access system tables, system management information, other configuration information, and metadata. Unauthorized access to this data could result in unauthorized changes to database objects, access controls, or SQL Server configuration. Only database administrators and other authorized users must be allowed such access. -SELECT pe.grantee_principal_id - , pr.type AS 'Grantee_Type' - , pr.name AS 'Grantee_Name' - , pe.type - , pe.permission_name - , pe.state - , pe.state_desc - FROM sys.server_permissions pe - JOIN sys.server_principals pr - ON pe.grantee_principal_id = pr.principal_id - JOIN sys.server_principals ps - ON pe.grantor_principal_id = ps.principal_id - LEFT JOIN sys.server_principals us - ON us.principal_id = pe.major_id - WHERE pr.type IN ('K', 'S', 'U') - AND pe.grantee_principal_id > 10 - AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', - 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', - 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') - AND NOT pr.name = @admin_Account_name - ORDER BY CASE pr.type - WHEN 'K' THEN 1 - WHEN 'S' THEN 2 - WHEN 'U' THEN 3 - ELSE 4 - END +To aid in tracking and administering such permissions, individual logins must not be directly granted permissions or built-in server roles. Instead, user-defined server roles must be created, with the permissions and built-in server roles granted to them; the individual logins must be assigned to the appropriate user-defined server roles. -If any user account list indicates direct access to any server permission, this is a finding. +The built-in server role "sysadmin" is a partial exception. This cannot be granted to a user-defined role, only to a login account. Most (not necessarily all) database administrators will need to be members of sysadmin. Without this, most DBCC commands and the system stored procedures/functions listed below are unavailable. The users who require such access must be documented and approved. -Obtain the list of available user-defined server roles from system documentation. +In addition, if the site uses backup-restore software that connects to SQL Server via the Virtual Device Interface (VDI), the account used by that software must have the sysadmin role. (See Microsoft Knowledge Base article 2926557, http://support.microsoft.com/kb/2926557). If this applies, it must be documented and approved. -Obtain the list of available user-defined server roles from the SQL Server system by running the following script: +Stored procedures/functions available only to the sysadmin role: +fn_yukonsecuritymodelrequired +sp_add_agent_parameter +sp_add_agent_profile +sp_adddatatype +sp_adddistributiondb +sp_adddistributor +sp_addqreader_agent +sp_addsubscriber +sp_addsubscriber_schedule +sp_addtabletocontents +sp_attachsubscription +sp_cdc_cleanup_change_table +sp_cdc_disable_db +sp_cdc_disable_table +sp_cdc_drop_job +sp_cdc_enable_db +sp_cdc_enable_table +sp_cdc_restoredb +sp_cdc_vupgrade +sp_certify_removable +sp_change_agent_parameter +sp_change_agent_profile +sp_change_subscription_properties +sp_change_users_login +sp_changedistpublisher +sp_changedistributiondb +sp_changedistributor_password +sp_changedistributor_property +sp_changemergesubscription +sp_changeqreader_agent +sp_changereplicationserverpasswords +sp_changesubscriptiondtsinfo +sp_checkinvalidivarticle +sp_copysubscription +sp_create_removable +sp_cycle_errorlog +sp_dbcmptlevel +sp_dbmmonitoraddmonitoring +sp_dbmmonitorchangealert +sp_dbmmonitordropalert +sp_dbmmonitordropmonitoring +sp_dbmmonitorhelpalert +sp_dbmmonitorhelpmonitoring +sp_dbmmonitorresults +sp_dbmmonitorupdate +sp_dbremove +sp_drop_agent_parameter +sp_drop_agent_profile +sp_dropdatatypemapping +sp_dropdistpublisher +sp_dropdistributiondb +sp_dropdistributor +sp_dropmergepullsubscription +sp_droppullsubscription +sp_dropsubscriber +sp_dsninfo +sp_enumdsn +sp_flush_commit_table_on_demand +sp_generate_agent_parameter +sp_get_distributor +sp_get_Oracle_publisher_metadata +sp_getagentparameterlist +sp_getdefaultdatatypemapping +sp_grant_publication_access +sp_help_agent_default +sp_help_agent_parameter +sp_help_agent_profile +sp_helpdistpublisher +sp_helpdistributor +sp_helpmergesubscription +sp_helpqreader_agent +sp_helpreplicationdboption +sp_identitycolumnforreplication +sp_IHValidateRowFilter +sp_IHXactSetJob +sp_link_publication +sp_monitor +sp_MSadd_distribution_agent +sp_MSadd_logreader_agent +sp_MSadd_merge_agent +sp_MSadd_snapshot_agent +sp_MSadd_subscriber_schedule +sp_MSadd_tracer_history +sp_MSadd_tracer_token +sp_MScdc_cleanup_job +sp_MScdc_db_ddl_event +sp_MScdc_ddl_event +sp_MSchange_distribution_agent_properties +sp_MSchange_logreader_agent_properties +sp_MSchange_merge_agent_properties +sp_MSchange_snapshot_agent_properties +sp_MSchangedynamicsnapshotjobatdistributor +sp_MSchangedynsnaplocationatdistributor +sp_MScheck_pull_access +sp_MScleanupmergepublisher_internal +sp_MSclear_dynamic_snapshot_location +sp_MScreate_dist_tables +sp_MSdbuserpriv +sp_MSdeletefoldercontents +sp_MSdrop_6x_replication_agent +sp_MSdrop_merge_agent +sp_MSdrop_snapshot_dirs +sp_MSdropmergedynamicsnapshotjob +sp_MSdynamicsnapshotjobexistsatdistributor +sp_MSenumallpublications +sp_MSfetchAdjustidentityrange +sp_MSfix_6x_tasks +sp_MSforce_drop_distribution_jobs +sp_MSget_agent_names +sp_MSget_jobstate +sp_MSget_oledbinfo +sp_MSget_publication_from_taskname +sp_MSgetdbversion +sp_MSgetmaxsnapshottimestamp +sp_MShelp_repl_agent +sp_MShelp_replication_status +sp_MShelp_snapshot_agent +sp_MShelpconflictpublications +sp_MShelpdynamicsnapshotjobatdistributor +sp_MShelplogreader_agent +sp_MShelpsnapshot_agent +sp_MShelptranconflictcounts +sp_MSinit_publication_access +sp_MSreinit_failed_subscriptions +sp_MSremoveoffloadparameter +sp_MSrepl_backup_complete +sp_MSrepl_backup_start +sp_MSrepl_createdatatypemappings +sp_MSrepl_dropdatatypemappings +sp_MSrepl_enumarticlecolumninfo +sp_MSrepl_enumpublications +sp_MSrepl_enumpublishertables +sp_MSrepl_enumsubscriptions +sp_MSrepl_enumtablecolumninfo +sp_MSrepl_getdistributorinfo +sp_MSrepl_startup_internal +sp_MSreplagentjobexists +sp_MSreplcheck_permission +sp_MSreplcheck_pull +sp_MSreplcheck_subscribe +sp_MSreplcheck_subscribe_withddladmin +sp_MSreplcopyscriptfile +sp_MSreplremoveuncdir +sp_MSsetalertinfo +sp_MSSetServerProperties +sp_MSsetupnosyncsubwithlsnatdist +sp_MSsetupnosyncsubwithlsnatdist_cleanup +sp_MSsetupnosyncsubwithlsnatdist_helper +sp_MSstartdistribution_agent +sp_MSstartmerge_agent +sp_MSstartsnapshot_agent +sp_MSstopdistribution_agent +sp_MSstopmerge_agent +sp_MSstopsnapshot_agent +sp_MSupdate_agenttype_default +sp_oledbinfo +sp_procoption +sp_removedbreplication +sp_removesrvreplication +sp_replication_agent_checkup +sp_replicationdboption +sp_resetstatus +sp_restoredbreplication +sp_SetAutoSAPasswordAndDisable +sp_setdefaultdatatypemapping +sp_updatestats +sp_validatelogins +sp_vupgrade_mergeobjects +sp_vupgrade_replication +sp_vupgrade_replsecurity_metadata +xp_repl_convert_encrypt_sysadmin_wrapper +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Use SQL Server and system documentation to determine privilege assignment of user-defined roles. + +Determine which user-defined roles grant privileges to system tables and configuration data stored in SQL Server. + +For each Login: + +In SQL Server Management Studio, Object Explorer, expand <SQL Server instance> >> Security >> Logins >> Right-click <login account name> >> Properties >> User >> Securables. + +If any item in the Explicit Permissions listing, for each highlighted item that exists in the Securables listing, indicates direct permission access, and that permission is anything other than Connect SQL, this is a finding. + +Navigate from Securables to Server Roles. + +If any Server Roles are checked from the following list, indicating direct permission access, this is a finding: +bulkadmin +dbcreator +diskadmin +processadmin +securityadmin +serveradmin +setupadmin + +If the sysadmin server role is checked, review system documentation to determine whether this login's need for the sysadmin role is documented and approved. If it is not, this is a finding. + +If any user-defined server roles with system table or configuration data privileges are checked, review system documentation to determine whether this login's need for the role is documented and approved. If it is not, this is a finding. + +Navigate from Server Roles to User Mapping. Select in turn each entry where the User column is non-blank. If any Database Roles are checked from the following list, indicating direct permission access, this is a finding: +db_accessadmin +db_backupoperator +db_datareader +db_datawriter +db_ddladmin +db_denydatareader +db_denydatawriter +db_owner +db_securityadmin + + + <VulnDiscussion>Applications employ the concept of least privilege for specific duties and information systems (including specific functions, ports, protocols, and services). The concept of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of information systems. + +Unauthorized access to sensitive data may compromise the confidentiality of personnel privacy, threaten national security or compromise a variety of other sensitive operations. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain the list of available user-defined server roles from system documentation. + +Obtain the list of available user-defined server roles from the SQL Server system by running the following script: /********************************************************************************** LIST ALL INDIRECT (via ROLES) ACCESS TO THE SERVER PERMISSION. ***********************************************************************************/ @@ -754,27 +821,29 @@ SELECT pe.grantee_principal_id If any listed user-defined roles are not found in the system documentation, this is a finding. -Obtain the list of user role assignments in the system documentation. +Obtain the list assigned privileges for all user-defined roles in the system documentation. -Check all SQL Server user-defined server roles for authorized and documented permission assignments. Repeat steps for each user-defined server role. -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Server Roles >> right click <'user-defined server role name'> >> Properties >> Members. If any roles are found that are not authorized and documented, this is a finding. - - - <VulnDiscussion>Non-DAC controls are determined by policy makers and are managed centrally or by a central authority. These controls must not be changed at the discretion of ordinary application users. Data protection requirements may result in a non-DAC policy being specified as part of the application design. Non-DACs are employed at the application level to restrict and control access to application data, thereby providing increased information security for the organization. +Check all SQL Server user-defined server roles for access rights as it relates to the separation of duties. Repeat steps for each user-defined server role. +Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Server Roles >> right click <'user-defined server role name'> >> Properties >> General >> Securables. If any user-defined role is assigned privileges that are not documented in the system documentation, this is a finding. -SQL Server Non-DAC is maintained through the use of Roles. Roles are set up within SQL Server to grant user accounts read and/or write permissions to system objects: databases, tables, columns, etc. After a role is created, user accounts can be assigned to a role granting them permissions of that role. +If any user-defined role contains permissions that are inconsistent with separation sensitive information assignment, this is a finding. -If users have permissions to database objects that they are not authorized to have, the user account that has access to the unauthorized database object must be removed from the role that grants that access. Policy rule sets would be developed to establish that each user receives only the information to which the user is authorized. +If system access requires more than one level of sensitive information access and the user-defined role names do not clearly differentiate between the different levels of sensitive information, this is a finding. + + + <VulnDiscussion>Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action. -Frequently, roles grant access to multiple privileges; if a user is authorized and determined to need access to authorized privilege granted by a role, and unauthorized for other privileges of that same role, it may be necessary to split the privileges of one role into two roles.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +Additionally, the person or entity accountable for monitoring the activity must be separate as well. To meet this requirement, applications, when applicable, shall be divided where functionality is based on roles and duties. Examples of separation of duties include: (i) mission functions and distinct information system support functions are divided among different individuals/roles; (ii) different individuals perform information system support functions (e.g., system management, systems programming, configuration management, quality assurance and testing, network security); (iii) security personnel who administer access control functions do not administer audit functions; and (iv) different administrator accounts for different roles. + +Privileges granted outside the role of the application user job function are more likely to go unmanaged or without oversight for authorization. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False Check for direct user assignment to server permissions by running the following script: /********************************************************************************** -LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT -SYSTEM ADMINISTRATOR ACCOUNTS. DO NOT LIST ROLES. + LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT + SYSTEM ADMINISTRATOR accounts. DO NOT LIST ROLES. ***********************************************************************************/ DECLARE @admin_Account_name sysname SET @admin_Account_name = 'NO administrator account found' @@ -782,14 +851,245 @@ DECLARE @server_name sysname SET @server_name = 'NO Server found' SELECT @server_name = name FROM sys.servers -WHERE server_id = 0 -SET @admin_Account_name = @server_name + '\Administrator' + WHERE server_id = 0 +SET @admin_Account_name = @server_name + '\Administrator' SELECT pe.grantee_principal_id -, pr.type AS 'Grantee_Type' -, pr.name AS 'Grantee_Name' -, pe.type -, pe.permission_name + , pr.type AS 'Grantee_Type' + , pr.name AS 'Grantee_Name' + , pe.type + , pe.permission_name + , pe.state + , pe.state_desc + FROM sys.server_permissions pe + JOIN sys.server_principals pr + ON pe.grantee_principal_id = pr.principal_id + JOIN sys.server_principals ps + ON pe.grantor_principal_id = ps.principal_id + LEFT JOIN sys.server_principals us + ON us.principal_id = pe.major_id + WHERE pr.type IN ('K', 'S', 'U') + AND pe.grantee_principal_id > 10 + AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', + 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', + 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') + AND NOT pr.name = @admin_Account_name + AND NOT pe.permission_name = 'connect sql' + ORDER BY CASE pr.type + WHEN 'K' THEN 1 + WHEN 'S' THEN 2 + WHEN 'U' THEN 3 + ELSE 4 + END + +If any user account list indicates direct access to any server permission, this is a finding. + +Obtain the list of available user-defined server roles from system documentation. + +Obtain the list of available user-defined server roles from the SQL Server system by running the following script: +/********************************************************************************** + LIST ALL INDIRECT (via ROLES) ACCESS TO THE SERVER PERMISSION. + ***********************************************************************************/ +DECLARE @admin_Account_name sysname +SET @admin_Account_name = 'NO admin ACCOUNT found' +DECLARE @server_name sysname +SET @server_name = 'NO Server found' + +SELECT @server_name = name FROM sys.servers + WHERE server_id = 0 +SET @admin_Account_name = @server_name + '\Administrator' + +SELECT pe.grantee_principal_id + , pr.type AS 'Grantee_Type' + , pr.name AS 'Grantee_Name' + , pe.type + , pe.permission_name + , pe.state + , pe.state_desc + FROM sys.server_permissions pe + JOIN sys.server_principals pr + ON pe.grantee_principal_id = pr.principal_id + JOIN sys.server_principals ps + ON pe.grantor_principal_id = ps.principal_id + LEFT JOIN sys.server_principals us + ON us.principal_id = pe.major_id + WHERE pr.type IN ('R') + AND pe.grantee_principal_id > 10 + AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', + 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', + 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') + AND NOT pr.name = @admin_Account_name + AND NOT pe.permission_name = 'connect sql' + ORDER BY CASE pe.state + WHEN 'D' THEN 1 + WHEN 'W' THEN 2 + WHEN 'G' THEN 3 + ELSE 4 + END + +If any listed user-defined roles are not found in the system documentation, this is a finding. + +Obtain the list of assigned privileges for all user-defined roles in the system documentation. + +Check all SQL Server user-defined server roles for access rights as it relates to the separation of duties. Repeat steps for each user-defined server role. +Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Server Roles >> right click <'user-defined server role name'> >> Properties >> General >> Securables. If any roles are found that do not enforce separation of duties, this is a finding. + + + <VulnDiscussion>Discretionary Access Control (DAC) is based on the premise that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). + +These DAC concepts extend to the server level. Server instances have the potential for the access controls to propagate without limit, resulting in unauthorized access. + +The DBMS must ensure the recipient of server permissions possesses only the access intended. The DBMS must enforce the ability to limit unauthorized rights propagation. If propagation is not prevented, users can continue to grant rights to other users without limit.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Check for rights propagation assignment to DBMS server permissions by running the following query: + +USE master; +SELECT * +FROM sys.server_permissions +WHERE state_desc = 'GRANT_WITH_GRANT_OPTION'; + +If any of the permissions listed have not been documented and approved as requiring GRANT_WITH_GRANT_OPTION, this is a finding. + + + <VulnDiscussion>Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) are employed by organizations to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, domains). + +DAC is a type of access control methodology serving as a means of restricting access to objects and data based on the identity of subjects and/or groups to which they belong. It is discretionary in the sense that application users with the appropriate permissions to access an application resource or data have the discretion to pass that permission on to another user either directly or indirectly. + +Data protection requirements may result in a DAC policy being specified as part of the application design. Discretionary access controls would be employed at the application level to restrict and control access to application objects and data, thereby providing increased information security for the organization. + +When DAC controls are employed, those controls must limit sharing to named application users, groups of users, or both. The application DAC controls must also limit the propagation of access rights and have the ability to exclude access to data down to the granularity of a single user. + +Databases using DAC must have the ability for the owner of an object or information to assign or revoke rights to view or modify the object or information. If the owner of an object or information does not have rights to exclude access to an object or information at a user level, users may gain access to objects and information they are not authorized to view/modify.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Check for direct user assignment to server permissions by running the following script: +/********************************************************************************** + LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT + SYSTEM ADMINISTRATOR accounts. DO NOT LIST ROLES. +***********************************************************************************/ +DECLARE @admin_Account_name sysname +SET @admin_Account_name = 'NO Administrator account found' +DECLARE @server_name sysname +SET @server_name = 'NO Server found' + +SELECT @server_name = name FROM sys.servers + WHERE server_id = 0 +SET @admin_Account_name = @server_name + '\Administrator' + +SELECT pe.grantee_principal_id + , pr.type AS 'Grantee_Type' + , pr.name AS 'Grantee_Name' + , pe.type + , pe.permission_name + , pe.state + , pe.state_desc + FROM sys.server_permissions pe + JOIN sys.server_principals pr + ON pe.grantee_principal_id = pr.principal_id + JOIN sys.server_principals ps + ON pe.grantor_principal_id = ps.principal_id + LEFT JOIN sys.server_principals us + ON us.principal_id = pe.major_id + WHERE pr.type IN ('K', 'S', 'U') + AND pe.grantee_principal_id > 10 + AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', + 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', + 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') + AND NOT pr.name = @admin_Account_name + ORDER BY CASE pr.type + WHEN 'K' THEN 1 + WHEN 'S' THEN 2 + WHEN 'U' THEN 3 + ELSE 4 + END + +If any user account list indicates direct access to any server permission, this is a finding. + +Obtain the list of available user-defined server roles from system documentation. + +Obtain the list of available user-defined server roles from the SQL Server system by running the following script: +/********************************************************************************** + LIST ALL INDIRECT (via ROLES) ACCESS TO THE SERVER PERMISSION. + ***********************************************************************************/ +DECLARE @admin_Account_name sysname +SET @admin_Account_name = 'NO admin ACCOUNT found' +DECLARE @server_name sysname +SET @server_name = 'NO Server found' + +SELECT @server_name = name FROM sys.servers + WHERE server_id = 0 +SET @admin_Account_name = @server_name + '\Administrator' + +SELECT pe.grantee_principal_id + , pr.type AS 'Grantee_Type' + , pr.name AS 'Grantee_Name' + , pe.type + , pe.permission_name + , pe.state + , pe.state_desc + FROM sys.server_permissions pe + JOIN sys.server_principals pr + ON pe.grantee_principal_id = pr.principal_id + JOIN sys.server_principals ps + ON pe.grantor_principal_id = ps.principal_id + LEFT JOIN sys.server_principals us + ON us.principal_id = pe.major_id + WHERE pr.type IN ('R') + AND pe.grantee_principal_id > 10 + AND NOT pr.name IN ('##MS_PolicyEventProcessingLogin##', '##MS_PolicyTsqlExecutionLogin##', + 'NT AUTHORITY\NETWORK SERVICE', 'NT AUTHORITY\SYSTEM', 'NT SERVICE\MSSQLSERVER', + 'NT SERVICE\SQLSERVERAGENT', 'NT SERVICE\SQLWriter', 'NT SERVICE\Winmgmt') + AND NOT pr.name = @admin_Account_name + ORDER BY CASE pe.state + WHEN 'D' THEN 1 + WHEN 'W' THEN 2 + WHEN 'G' THEN 3 + ELSE 4 + END + +If any listed user-defined roles are not found in the system documentation, this is a finding. + +Obtain the list of user role assignments in the system documentation. + +Check all SQL Server user-defined server roles for authorized and documented permission assignments. Repeat steps for each user-defined server role. +Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Server Roles >> right click <'user-defined server role name'> >> Properties >> Members. If any roles are found that are not authorized and documented, this is a finding. + + + <VulnDiscussion>Non-DAC controls are determined by policy makers and are managed centrally or by a central authority. These controls must not be changed at the discretion of ordinary application users. Data protection requirements may result in a non-DAC policy being specified as part of the application design. Non-DACs are employed at the application level to restrict and control access to application data, thereby providing increased information security for the organization. + +SQL Server Non-DAC is maintained through the use of Roles. Roles are set up within SQL Server to grant user accounts read and/or write permissions to system objects: databases, tables, columns, etc. After a role is created, user accounts can be assigned to a role granting them permissions of that role. + +If users have permissions to database objects that they are not authorized to have, the user account that has access to the unauthorized database object must be removed from the role that grants that access. Policy rule sets would be developed to establish that each user receives only the information to which the user is authorized. + +Frequently, roles grant access to multiple privileges; if a user is authorized and determined to need access to authorized privilege granted by a role, and unauthorized for other privileges of that same role, it may be necessary to split the privileges of one role into two roles.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Check for direct user assignment to server permissions by running the following script: +/********************************************************************************** +LIST ALL DIRECT SERVER PERMISSIONS TO ANY ACCOUNT EXCEPT +SYSTEM ADMINISTRATOR ACCOUNTS. DO NOT LIST ROLES. +***********************************************************************************/ +DECLARE @admin_Account_name sysname +SET @admin_Account_name = 'NO administrator account found' +DECLARE @server_name sysname +SET @server_name = 'NO Server found' + +SELECT @server_name = name FROM sys.servers +WHERE server_id = 0 +SET @admin_Account_name = @server_name + '\Administrator' + +SELECT pe.grantee_principal_id +, pr.type AS 'Grantee_Type' +, pr.name AS 'Grantee_Name' +, pe.type +, pe.permission_name , pe.state , pe.state_desc FROM sys.server_permissions pe @@ -876,7 +1176,7 @@ When determining the appropriate values for this limit, take the characteristics Architectural note: In SQL Server, a count of active sessions by user can be obtained from one of the dynamic management views. For example: - SELECT original_login_name, count(*) + SELECT original_login_name, count(*) FROM sys.dm_exec_sessions WHERE is_user_process = 1 GROUP BY original_login_name; @@ -890,13 +1190,13 @@ However, for this to return an accurate count in a logon trigger, the user would If one limit has been defined but is not applied to all users, including privileged administrative accounts, this is a finding. -If multiple limits have been defined, to accommodate different types of user, verify that together they cover all users. If not, this is a finding. +If multiple limits have been defined, to accommodate different types of user, verify that together they cover all users. If not, this is a finding. If a mechanism other than a logon trigger is used, verify its correct operation by the appropriate means. If it does not work correctly, this is a finding. Otherwise, determine if a logon trigger exists: -EITHER, in SQL Server Management Studio's Object Explorer tree: +EITHER, in SQL Server Management Studio's Object Explorer tree: Expand [SQL Server Instance] >> Security >> Server Objects >> Triggers OR run the query: @@ -904,7 +1204,7 @@ SELECT * FROM master.sys.server_triggers; If no triggers are listed, this is a finding. -If triggers are listed, identify the one(s) limiting the number of concurrent sessions per user. If none are found, this is a finding. If they are present but disabled, this is a finding. +If triggers are listed, identify the one(s) limiting the number of concurrent sessions per user. If none are found, this is a finding. If they are present but disabled, this is a finding. Examine the trigger source code for logical correctness and for compliance with the documented limit(s). If errors or variances exist, this is a finding. @@ -969,12 +1269,12 @@ To enforce this in SQL Server, configure each DBMS-managed login to inherit the Run the statement: SELECT name -FROM - sys.sql_logins +FROM + sys.sql_logins WHERE type_desc = 'SQL_LOGIN' AND is_disabled = 0 - AND is_policy_checked = 0 ; + AND is_policy_checked = 0 ; If no account names are listed, this is not a finding. @@ -1035,7 +1335,7 @@ Database logs can be monitored for specific security-related errors. Any error t False False - Security-related errors must be identified and monitored. In most cases, these items would appear in the SQL Server log file. + Security-related errors must be identified and monitored. In most cases, these items would appear in the SQL Server log file. If security-related error conditions are not being monitored to meet this requirement, this is a finding. @@ -1054,9 +1354,9 @@ Database Management Systems typically separate security functionality from nonse For any elements found, check SQL Server to determine if these objects or code implementing security functionality are located in a separate security domain, such as a separate database or schema created specifically for security functionality. Run the following queryto list all the user-defined databases: -SELECT Name -FROM sys.databases -WHERE database_id > 4 +SELECT Name +FROM sys.databases +WHERE database_id > 4 ORDER BY 1; If security-related database objects or code are not kept separate, this is a finding. @@ -1099,7 +1399,7 @@ Passwords stored in clear text are vulnerable to unauthorized disclosure. Databa False False - Since Windows security is being leveraged, this check applies to database configuration files, associated scripts, and applications external to SQL Server that access the database. + Since Windows security is being leveraged, this check applies to database configuration files, associated scripts, and applications external to SQL Server that access the database. Ask the DBA and/or IAO to determine if any SQL Server database objects, database configuration files, associated scripts, or applications defined as external to SQL Server that access the database/user environment files/settings contain database passwords. If any do, confirm that SQL Server passwords stored externally to the SQL Server are encoded or encrypted. If any passwords are stored in clear text, this is a finding. @@ -1218,14 +1518,14 @@ SELECT ''?'' AS ''database name'' WHERE type_desc = ''LOG'' AND state = 0; ' -; +; If any transaction log files are not configured correctly for size, max_size, and growth to log sufficient transaction information, this is a finding. - <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -Additionally, it is sometimes convenient to provide multiple services from a single component of an information system (e.g., email and web services) but doing so increases risk over limiting the services provided by any one component. +Additionally, it is sometimes convenient to provide multiple services from a single component of an information system (e.g., email and web services) but doing so increases risk over limiting the services provided by any one component. To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. @@ -1275,9 +1575,9 @@ SELECT ''?'' AS ''Table Name'', * If any user-defined Stored Procedures and Functions are unauthorized and therefore should be prohibited or restricted and are not, this is a finding. - <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements; or providing a wide array of functionality not required for every mission, but which cannot be disabled. +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plug-ins not related to requirements; or providing a wide array of functionality not required for every mission, but which cannot be disabled. Applications must adhere to the principles of least functionality by providing only essential capabilities. @@ -1299,7 +1599,7 @@ If the value of config_value is 1, this is a finding. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -It is detrimental for applications to provide or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled. +It is detrimental for applications to provide or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, yet cannot be disabled. Applications must adhere to the principles of least functionality by providing only essential capabilities. @@ -1369,24 +1669,122 @@ If the "SQL Server Reporting Services (MSSQLSERVER)" service does not exist, thi If the "SQL Server Reporting Services (MSSQLSERVER)" status is "Started" or the "Startup Type" is not set to "Disabled", this is a finding. - - <VulnDiscussion>Security faults with software applications and operating systems are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. + + <VulnDiscussion>When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. -Any time new software code is introduced to a system there is the potential for unintended consequences. There have been documented instances where the application of a patch has caused problems with system integrity or availability. Due to information system integrity and availability concerns, organizations must give careful consideration to the methodology used to carry out automatic updates. +If any user were allowed to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. The DBMS software libraries contain the executables used by the DBMS to operate. Unauthorized access to the libraries can result in compromised installations. This may in turn jeopardize data stored in the DBMS and/or operation of the host system. -If SQL Server were no longer supported, no patches from Microsoft would address newly discovered security vulnerabilities. Unpatched software is vulnerable to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +Accordingly, only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. + +Of particular note in this context is that any software installed for auditing and/or audit file management must be protected and monitored.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False - Check Microsoft's list of supported SQL Server versions. To locate the correct web page, perform a web search for "Microsoft SQL Server end of support." - -To be considered supported, Microsoft must report that the version is supported by security patches to known vulnerabilities. - -Check SQL Server version by running the following command: -print @@version - -If the security patch support for SQL Server cannot be determined or SQL Server version is not shown as supported, this is a finding. + Obtain the SQL Server software directory location: from a command prompt, open the registry editor by typing regedit.exe and pressing [ENTER]. Navigate to the following registry location: +HKEY_LOCAL_MACHINE +>> SOFTWARE +>> Microsoft +>> Microsoft SQL Server +>> [INSTANCE NAME] +>> Setup +>> SQLBinRoot + +In the registry tree, the [INSTANCE NAME] for a SQL Server 2012 database engine instance is normally shown as "MSSQL11" followed by a period and the name that was specified for the SQL Server service at installation time. If multiple SQL Server instances are installed, each will have its own [INSTANCE NAME] node and subtree in the registry. + +The value in the Data column for the SQLBinRoot registry entry is the file system path for the SQL Server 2012 binaries. Navigate to that folder location using a command prompt or Windows Explorer. The following instructions assume that Windows Explorer is used. + +Verify that files and folders that are part of the SQL Server 2012 instance have only authorized privileges. Right-click the binaries (\binn) folder, click Properties. On the Security tab, verify that at most the following permissions are present: +Trusted Installer (Full Control) +CREATOR OWNER (Full Control) +SYSTEM (Full Control) +Administrators (Full Control) [See Note 3] +Users (Read, List Folder Contents, Read & Execute) +Creator Owner (Special Permissions - Full control - Subfolders and files only) +All Application Packages (Read & Execute) [Only as needed - see Note 4] +SQL Server Service SID OR Service Account (Read & Execute) [Notes 1, 2] +SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Full Control) [Notes 1, 2] +SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read & Execute) [Notes 1, 2] +System Administrators (Full Control) [Note 3] + +If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. + +Right-click each folder under the binaries folder; click Properties. On the Security tab, verify that at most the permissions listed in the preceding paragraph are present. +If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. + +Right-click the \Install folder, which is a peer of \binn, under ...\MSSQL. On the Security tab, verify that at most the permissions listed in the preceding paragraphs are present. If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. + + +Locate the ...\Microsoft SQL Server\110\Shared folder, either by stepping up the tree in Windows Explorer or by finding the file path in the registry at: +HKEY_LOCAL_MACHINE +>> SOFTWARE +>> Microsoft +>> Microsoft SQL Server +>> 110 +>> SharedCode + +Right-click on the ...\110\Shared folder; click Properties. On the Security tab, verify that at most the following permissions are present: +Trusted Installer (Full Control) +CREATOR OWNER (Full Control) +System (Full Control) +SQL Server Service SID OR Service Account (Read & Execute) [Notes 1, 2] +System Administrators (Full Control) [Note 3] +Local Administrators (Read) +SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read & Execute) [Notes 1, 2] +SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] +SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Write) [Notes 1, 2] +Users (Read, List Folder Contents, Read & Execute) +[MsDtsServer110 (Read & Execute) is also permitted, if SSIS/DTS is in use.] +[NT AUTHORITY\NETWORK SERVICE (Read & Execute) may also be required for SQL Server Configuration Manager to operate.] + +If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. + +Right-click each folder under the ...\110\Shared folder; click Properties. On the Security tab, verify that at most the permissions listed in the preceding paragraph are present. If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. + +----- + +Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control because these permissions are available only to the specific service when it is running and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.110).aspx. + +Note 2: Tips for adding a service SID/virtual account to a folder's permission list. +1) In Windows Explorer, right-click on the folder and select "Properties." +2) Select the "Security" tab +3) Click "Edit" +4) Click "Add" +5) Click "Locations" +6) Select the computer name +7) Search for the name +7.a) SQL Server Service +7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) +7.a.ii) Select the "MSSQL$<instance name>" user and click "OK" +7.b) SQL Agent Service +7.b.i) Type "NT SERVICE\SQL" and click "Check Names" +7.b.ii) Select the "SQLAgent$<instance name>" user and click "OK" +8) Click "OK" +9) Permission like a normal user from here + +Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only. + +Note 4: Some files also require 'ALL APPLICATION PACKAGES (READ, EXECUTE)' permissions for certain functionality to work appropriately, and this is considered acceptable where those permissions are required. (All SQL Server files that require this access reside by default in the ..\Microsoft SQL Server\110\ directory.) + + + + <VulnDiscussion>Security faults with software applications and operating systems are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. + +Any time new software code is introduced to a system there is the potential for unintended consequences. There have been documented instances where the application of a patch has caused problems with system integrity or availability. Due to information system integrity and availability concerns, organizations must give careful consideration to the methodology used to carry out automatic updates. + +If SQL Server were no longer supported, no patches from Microsoft would address newly discovered security vulnerabilities. Unpatched software is vulnerable to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Check Microsoft's list of supported SQL Server versions. To locate the correct web page, perform a web search for "Microsoft SQL Server end of support." + +To be considered supported, Microsoft must report that the version is supported by security patches to known vulnerabilities. + +Check SQL Server version by running the following command: +print @@version + +If the security patch support for SQL Server cannot be determined or SQL Server version is not shown as supported, this is a finding. If SQL Server does not contain the latest security patches, this is a finding. @@ -1395,7 +1793,7 @@ SQL Server 2012 Enterprise Core mainstream support end date: 7/11/2018 SQL Server 2012 Enterprise Core extended support end date: 7/12/2022 - <VulnDiscussion>When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. + <VulnDiscussion>When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. Multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit of one application can lead to an exploit of other applications sharing the same security context. For example, an exploit of a web server process that leads to unauthorized administrative access to host system directories can most likely lead to a compromise of all applications hosted by the same system. Database software not installed using dedicated directories both threatens and is threatened by other hosted applications. Access controls defined for one application may by default provide access to other applications’ database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -1412,15 +1810,15 @@ Analysis Services Instances are registered in the OLAP subfolder. Reporting Services Instances are registered in the RS subfolder. Standard SQL Server Instances are registered in the SQL subfolder. -Inside each of these folders, a single key is used to reference an Instance's specific Windows Registry tree. Each key will have its own registry tree at the following registry location: +Inside each of these folders, a single key is used to reference an Instance's specific Windows Registry tree. Each key will have its own registry tree at the following registry location: HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Microsoft SQL Server >> [INSTANCE NAME]. -An [INSTANCE NAME] is listed as the Data component of a key found in one of the above OLAP, RS, or SQL folders. +An [INSTANCE NAME] is listed as the Data component of a key found in one of the above OLAP, RS, or SQL folders. To find the installation location of a particular instance, navigate to the following location in the Windows Registry: -HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Microsoft SQL Server >> [INSTANCE NAME] >> Setup. +HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Microsoft SQL Server >> [INSTANCE NAME] >> Setup. Examine the value of the 'SqlProgramDir' key. The value of the 'SqlProgramDir' key is the SQL Server installation directory for that SQL Server Instance. @@ -1454,7 +1852,7 @@ Standard SQL Server Instances are registered in the SQL subfolder. Inside each one of these folders, a single key is used to reference an instance's specific Windows Registry tree. Each key will have its own registry tree at the following registry location: HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Microsoft SQL Server >> [INSTANCE NAME]. -An [INSTANCE NAME] is listed as the data component of a key found in one of the above OLAP, RS, or SQL folders. +An [INSTANCE NAME] is listed as the data component of a key found in one of the above OLAP, RS, or SQL folders. To find the installation location of a particular instance, navigate to the following location in the Windows Registry: HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Microsoft SQL Server >> [INSTANCE NAME] >> Setup. Examine the value of the 'SqlProgramDir' key. The value of the 'SqlProgramDir' key is the SQL Server installation directory for that SQL Server Instance. @@ -1480,7 +1878,7 @@ Deletion of database audit data could mask the theft or unauthorized modificatio False Obtain the SQL Server audit file location(s) by running the following SQL script: -SELECT DISTINCT +SELECT DISTINCT LEFT(path, (LEN(path) - CHARINDEX('\',REVERSE(path)) + 1)) AS "Audit Path" FROM sys.traces UNION @@ -1496,10 +1894,10 @@ Administrator(read) Users (none) Audit Administrator (Full Control) Auditors group (Read) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] +SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] -If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding. +If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding. If less restrictive permissions are present and specifically justified and approved in the system security plan, this is not a finding ----- @@ -1540,7 +1938,7 @@ Modification of database audit data could mask the theft or unauthorized modific False Obtain the SQL Server audit file location(s) by running the following SQL script: -SELECT DISTINCT +SELECT DISTINCT LEFT(path, (LEN(path) - CHARINDEX('\',REVERSE(path)) + 1)) AS "Audit Path" FROM sys.traces UNION @@ -1556,10 +1954,10 @@ Administrator(read) Users (none) Audit Administrator (Full Control) Auditors group (Read) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] +SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] -If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding. +If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding. If less restrictive permissions are present and specifically justified and approved in the system security plan, this is not a finding. @@ -1580,7 +1978,7 @@ Audit information includes all information (e.g., audit records, audit settings, False Obtain the SQL Server audit file location(s) by running the following SQL script: -SELECT DISTINCT +SELECT DISTINCT LEFT(path, (LEN(path) - CHARINDEX('\',REVERSE(path)) + 1)) AS "Audit Path" FROM sys.traces UNION @@ -1596,11 +1994,11 @@ Administrator(read) Users (none) Audit Administrator (Full Control) Auditors group (Read) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] +SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] -If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding. +If any less restrictive permissions are present and not specifically justified and approved in the system security plan, this is a finding. If less restrictive permissions are present and specifically justified and approved in the system security plan, this is not a finding. @@ -1640,7 +2038,7 @@ If an attacker were to gain access to audit tools, they could analyze audit logs False Obtain the SQL Server audit file location(s) by running the following SQL script: -SELECT DISTINCT +SELECT DISTINCT LEFT(path, (LEN(path) - CHARINDEX('\',REVERSE(path)) + 1)) AS "Audit Path" FROM sys.traces UNION @@ -1680,7 +2078,7 @@ Expand Quota Management. Select Quotas. If Quotas have not been created for defined Audit Log storage locations that meet organizationally defined requirements, this is a finding. -In the center pane, select each quota to determine its Path, Limit, Type, and Description. +In the center pane, select each quota to determine its Path, Limit, Type, and Description. Right click the appropriate quota or quotas, and click Edit Quota Properties. Examine the Notification thresholds panel. If there are no Notification thresholds applied to this Quota, this is a finding. @@ -1698,12 +2096,12 @@ After the initial setup of SQL Server audit log configuration, it is best to che False False - Check the SQL Server audit setting on the maximum file size of the trace used for the auditing requirement. + Check the SQL Server audit setting on the maximum file size of the trace used for the auditing requirement. -Select * from sys.traces. Determine the audit being used to fulfill the overall auditing requirement. Examine the max_files and max_size parameters. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost. +Select * from sys.traces. Determine the audit being used to fulfill the overall auditing requirement. Examine the max_files and max_size parameters. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost. -The amount of space determined for logging by SQL Server is calculated by multiplying the maximum number of files by the maximum file size. +The amount of space determined for logging by SQL Server is calculated by multiplying the maximum number of files by the maximum file size. If auditing will outgrow the space reserved for logging before being overwritten, this is a finding. @@ -1792,7 +2190,7 @@ Many sites distribute a single SQL Server connection configuration file to all s Check procedures for providing SQL Server database connection information to users/applications. If procedures do not indicate or implement restrictions to connections required by the particular user/application which indicate process of least privilege and specific authorization was employed, this is a finding. - <VulnDiscussion>Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action. + <VulnDiscussion>Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action. The concept of separation of duties extends to processes. The DBMS must run under a custom, dedicated OS or domain account. When the DBMS is running under a shared account, users with access to that account could inadvertently or maliciously make changes to the DBMS’s settings, files, or permissions. Similarly, related services must run under dedicated accounts where this is possible. The SQL Server Browser and Writer services are exceptions: see http://msdn.microsoft.com/en-us/library/hh510203(v=sql.110).aspx and http://msdn.microsoft.com/en-us/library/ms175536(v=sql.110).aspx.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -1834,18 +2232,18 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'Unsafe assembly' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Unsafe assembly' + what.permission_name = 'Unsafe assembly' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name @@ -1855,14 +2253,14 @@ GO If any role has 'Grant', 'With Grant' or 'Deny' privileges to the 'Unsafe assembly' permission and the role is not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -1907,7 +2305,7 @@ ORDER BY GO - <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. + <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. @@ -1924,18 +2322,18 @@ Note that this does not apply to logins with names of the form '##MS...##'. Thes Obtain the list of accounts that have direct access to the server-level permission 'Alter any availability group' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Alter any availability group' + what.permission_name = 'Alter any availability group' AND who.name NOT LIKE '##MS%##' AND who.type_desc <> 'SERVER_ROLE' ORDER BY @@ -1946,14 +2344,14 @@ GO If any user accounts have direct access to the 'Alter any availability group' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -2014,14 +2412,14 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the 'Shutdown' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -2030,19 +2428,19 @@ AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -2102,35 +2500,35 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'External access assembly' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'External access assembly' + what.permission_name = 'External access assembly' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -2190,14 +2588,14 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'Create trace event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -2206,19 +2604,19 @@ AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -2278,14 +2676,14 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'Create server role' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -2294,19 +2692,19 @@ AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -2368,35 +2766,35 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Create endpoint' + what.permission_name = 'Create endpoint' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -2456,35 +2854,35 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'Create DDL event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Create DDL event notification' + what.permission_name = 'Create DDL event notification' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -2544,35 +2942,35 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'Create availability group' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Create availability group' + what.permission_name = 'Create availability group' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -2632,23 +3030,23 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'Alter any server audit' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Alter any server audit' + what.permission_name = 'Alter any server audit' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. @@ -2668,35 +3066,35 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'View any definition' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'View any definition' + what.permission_name = 'View any definition' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -2758,14 +3156,14 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -2774,19 +3172,19 @@ AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -2846,35 +3244,35 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'Alter resources' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Alter resources' + what.permission_name = 'Alter resources' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -2934,35 +3332,35 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'Alter any availability group' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Alter any availability group' + what.permission_name = 'Alter any availability group' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -3022,35 +3420,35 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'Alter any login' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Alter any login' + what.permission_name = 'Alter any login' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -3110,35 +3508,35 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'Alter any linked server' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Alter any linked server' + what.permission_name = 'Alter any linked server' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -3198,35 +3596,35 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'View server state' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'View server state' + what.permission_name = 'View server state' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -3286,35 +3684,35 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'Alter trace' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Alter trace' + what.permission_name = 'Alter trace' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -3374,35 +3772,35 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'Control server' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Control server' + what.permission_name = 'Control server' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -3462,14 +3860,14 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'Alter any server role' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -3478,19 +3876,19 @@ AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -3550,35 +3948,35 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'Alter Settings' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Alter Settings' + what.permission_name = 'Alter Settings' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -3638,35 +4036,35 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'Authenticate server' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Authenticate server' + what.permission_name = 'Authenticate server' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -3726,35 +4124,35 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'Create any database' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Create any database' + what.permission_name = 'Create any database' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -3800,816 +4198,252 @@ GO <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any connection' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any connection' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Obtain the list of roles that are authorized for the SQL Server 'Alter any connection' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any connection' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - - - <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any credential' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any credential' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Obtain the list of roles that are authorized for the SQL Server 'Alter any credential' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any credential' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - - - <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any database' permission is a high server-level privilege that must only be granted to individual administration accounts through roles If the 'Alter any database' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Obtain the list of roles that are authorized for the SQL Server 'Alter any database' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any database' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - - - <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any endpoint' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any endpoint' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Obtain the list of roles that are authorized for the SQL Server 'Alter any endpoint' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any endpoint' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - - - <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any event session' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any event session' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Obtain the list of roles that are authorized for the SQL Server 'Alter any event session' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter any event session' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - - - <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter server state' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'Alter server state' permissions are granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Obtain the list of roles that are authorized for the SQL Server 'Alter server state' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. - -Obtain the list of roles with that permission by running the following query: - -SELECT - who.name AS [Principal Name], - who.type_desc AS [Principal Type], - who.is_disabled AS [Principal Is Disabled], - what.state_desc AS [Permission State], - what.permission_name AS [Permission Name] -FROM - sys.server_permissions what - INNER JOIN sys.server_principals who - ON who.principal_id = what.grantee_principal_id -WHERE - what.permission_name = 'Alter server state' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY - who.name -; -GO - -If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. - - - <VulnDiscussion>Backup and recovery of the Service Master Key may be critical to the complete recovery of the database. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Review procedures for, and evidence of backup of, the SQL Server Service Master Key in the System Security Plan. - -If the procedures or evidence do not exist, this is a finding. - -If the procedures do not indicate offline and off-site storage of the Service Master Key, this is a finding. - -If procedures do not indicate access restrictions to the Service Master Key backup, this is a finding. - - - <VulnDiscussion>Separate accounts used to manage the SQL Server platform help prevent a lateral move within an environment if SQL were to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Determine the accounts being used to manage the SQL Server operating system. Determine whether the same accounts are being used to manage other platforms. If the same account is used to manage more than one platform, this is a finding. -Note: If, because of the application configuration, there are multiple instances of SQL that would share a given exploit, a single account would be allowed to be used for the group and would not be considered a finding. - - - - <VulnDiscussion>Database files must be protected from unauthorized access. Although default data locations are created at installation time, sites can, and will, use other directories for site-created database files to comply with best practices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Obtain the SQL Server data directory location(s): in a tool such as SQL Server Management Studio, run the statement: -SELECT DISTINCT -LEFT(physical_name, (LEN(physical_name) - CHARINDEX('\',REVERSE(physical_name)) + 1 )) -AS "Database Data File Paths", -type_desc -FROM sys.master_files -WHERE database_id > 4 -AND type = 0 - -The query result is a list of file systems locations used for databases other than the system databases. Navigate to each of those folder locations using a command prompt or Windows Explorer. The following instructions assume that Windows Explorer is used. - - -Verify that the identified folders and their contents have only authorized privileges. Right-click each folder, click Properties. On the Security tab, verify that at most the following permissions are present: -CREATOR OWNER (Full Control) -System (Full control) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -System Administrators (Full Control) [Note 3] -SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read & Execute) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] -SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Write) [Notes 1, 2] -If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - - - <VulnDiscussion>Use of privileged accounts for non-administrative purposes puts data at risk of unintended or unauthorized loss, modification, or exposure. In particular, DBA accounts, if used for non-administration application development or application maintenance, can lead to excessive privileges where privileges are inherited by object owners. It may also lead to loss or compromise of application data where the elevated privileges bypass controls designed in and provided by applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Review procedures and practices. If there is not a policy requiring owners of privileged accounts to use non-privileged accounts for non-administrative activities, this is a finding. If there is evidence that owners of privileged accounts do not adhere to this policy, this is a finding. - - - <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. - -Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. - -SQL Server's 'Alter any event notification' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any event notification' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. - -Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. - -The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Obtain the list of roles that are authorized for the SQL Server 'Alter any event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: - -SELECT -who.name AS [Principal Name], -who.type_desc AS [Principal Type], -who.is_disabled AS [Principal Is Disabled], -what.state_desc AS [Permission State], -what.permission_name AS [Permission Name] -FROM -sys.server_permissions what -INNER JOIN sys.server_principals who -ON who.principal_id = what.grantee_principal_id -WHERE -what.permission_name = 'Alter any event notification' -AND who.type_desc = 'SERVER_ROLE' -ORDER BY -who.name -; -GO - - - - - - <VulnDiscussion>SQL Server is capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software demonstrations, or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled. - -Applications must adhere to the principles of least functionality by providing only essential capabilities. - -Unused and unnecessary SQL Server components increase the number of available attack vectors to SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. Components of the system that are unused and cannot be uninstalled must be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - - Review the components and features included in SQL Server and capable of being disabled (by configuration settings, permissions and privileges, etc.). Take note of those which are enabled. - -Review the system documentation to verify that the enabled components or features are documented and authorized. If any enabled components or features are not authorized, this is a finding. - - - - - - - Creator Owner (Special Permissions - False - - - - - - - - - All Application Packages (Read & Execute) [Only as needed - False - - - - - - - <VulnDiscussion>When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. - -If any user were allowed to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. The DBMS software libraries contain the executables used by the DBMS to operate. Unauthorized access to the libraries can result in compromised installations. This may in turn jeopardize data stored in the DBMS and/or operation of the host system. - -Accordingly, only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. - -Of particular note in this context is that any software installed for auditing and/or audit file management must be protected and monitored.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - - Obtain the SQL Server software directory location: from a command prompt, open the registry editor by typing regedit.exe and pressing [ENTER]. Navigate to the following registry location: -HKEY_LOCAL_MACHINE ->> SOFTWARE ->> Microsoft ->> Microsoft SQL Server ->> [INSTANCE NAME] ->> Setup ->> SQLBinRoot - -In the registry tree, the [INSTANCE NAME] for a SQL Server 2012 database engine instance is normally shown as "MSSQL11" followed by a period and the name that was specified for the SQL Server service at installation time. If multiple SQL Server instances are installed, each will have its own [INSTANCE NAME] node and subtree in the registry. - -The value in the Data column for the SQLBinRoot registry entry is the file system path for the SQL Server 2012 binaries. Navigate to that folder location using a command prompt or Windows Explorer. The following instructions assume that Windows Explorer is used. - -Verify that files and folders that are part of the SQL Server 2012 instance have only authorized privileges. Right-click the binaries (\binn) folder, click Properties. On the Security tab, verify that at most the following permissions are present: -Trusted Installer (Full Control) -CREATOR OWNER (Full Control) -SYSTEM (Full Control) -Administrators (Full Control) [See Note 3] -Users (Read, List Folder Contents, Read & Execute) -Creator Owner (Special Permissions - Full control - Subfolders and files only) -All Application Packages (Read & Execute) [Only as needed - see Note 4] -SQL Server Service SID OR Service Account (Read & Execute) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Full Control) [Notes 1, 2] -SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read & Execute) [Notes 1, 2] -System Administrators (Full Control) [Note 3] - -If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - -Right-click each folder under the binaries folder; click Properties. On the Security tab, verify that at most the permissions listed in the preceding paragraph are present. -If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - -Right-click the \Install folder, which is a peer of \binn, under ...\MSSQL. On the Security tab, verify that at most the permissions listed in the preceding paragraphs are present. If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - - -Locate the ...\Microsoft SQL Server\110\Shared folder, either by stepping up the tree in Windows Explorer or by finding the file path in the registry at: -HKEY_LOCAL_MACHINE ->> SOFTWARE ->> Microsoft ->> Microsoft SQL Server ->> 110 ->> SharedCode - -Right-click on the ...\110\Shared folder; click Properties. On the Security tab, verify that at most the following permissions are present: -Trusted Installer (Full Control) -CREATOR OWNER (Full Control) -System (Full Control) -SQL Server Service SID OR Service Account (Read & Execute) [Notes 1, 2] -System Administrators (Full Control) [Note 3] -Local Administrators (Read) -SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read & Execute) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] -SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Write) [Notes 1, 2] -Users (Read, List Folder Contents, Read & Execute) -[MsDtsServer110 (Read & Execute) is also permitted, if SSIS/DTS is in use.] -[NT AUTHORITY\NETWORK SERVICE (Read & Execute) may also be required for SQL Server Configuration Manager to operate.] - -If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - -Right-click each folder under the ...\110\Shared folder; click Properties. On the Security tab, verify that at most the permissions listed in the preceding paragraph are present. If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - ------ - -Note 1: It is highly advisable to use a separate account for each service. When installing SQL Server in single-server mode, you can opt to have these provisioned for you. These automatically generated accounts are referred to as virtual accounts. Each virtual account has an equivalent Service SID, with the same name. The installer also creates an equivalent SQL Server login, also with the same name. Applying folder and file permissions to Service SIDs, rather than to domain accounts or local computer accounts, provides tighter control because these permissions are available only to the specific service when it is running and not in any other context. (However, when using failover clustering, a domain account must be specified at installation, rather than a virtual account.) For more on this topic, see http://msdn.microsoft.com/en-us/library/ms143504(v=sql.110).aspx. - -Note 2: Tips for adding a service SID/virtual account to a folder's permission list. -1) In Windows Explorer, right-click on the folder and select "Properties." -2) Select the "Security" tab -3) Click "Edit" -4) Click "Add" -5) Click "Locations" -6) Select the computer name -7) Search for the name -7.a) SQL Server Service -7.a.i) Type "NT SERVICE\MSSQL" and click "Check Names". (What you have just typed in is the first 16 characters of the name. At least one character must follow "NT SERVICE\"; you will be presented with a list of all matches. If you have typed in the full, correct name, step 7.a.ii is bypassed.) -7.a.ii) Select the "MSSQL$<instance name>" user and click "OK" -7.b) SQL Agent Service -7.b.i) Type "NT SERVICE\SQL" and click "Check Names" -7.b.ii) Select the "SQLAgent$<instance name>" user and click "OK" -8) Click "OK" -9) Permission like a normal user from here - -Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only. - -Note 4: Some files also require 'ALL APPLICATION PACKAGES (READ, EXECUTE)' permissions for certain functionality to work appropriately, and this is considered acceptable where those permissions are required. (All SQL Server files that require this access reside by default in the ..\Microsoft SQL Server\110\ directory.) - - - - - - - - Everyone - - - This folder subfolders and files - Traverse,ExecuteFile,ListDirectory,ReadData,ReadAttributes,ReadExtendedAttributes,CreateFiles,WriteData,CreateDirectories,AppendData,WriteAttributes,WriteExtendedAttributes,Delete,ReadPermissions - - - <VulnDiscussion>Any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. - -Accordingly, only qualified and authorized individuals are allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. - -Access restrictions for change also include software libraries. - -Examples of access restrictions include: physical access controls (such as locks and access cards), logical access controls (such as ACLs), automated auditing (logging) of logical access, workflow automation, media libraries, abstract layers (e.g., changes are implemented into a third-party interface rather than directly into the information system component), and change windows (e.g., changes occur only during specified times, making unauthorized changes outside the window easy to discover). - -This requirement focuses on the auditing aspect of the protections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - True - - - Verify that Files and Folders that are part of the SQL Server 2012 Installation have auditing enabled. - -Right click the root folder of the SQL Server installation. Typically, this is at <drive>:\Program Files\Microsoft SQL Server\. Select Properties. - -Click on the Security tab - -Click on the Advanced button - -Click on the Auditing tab - -If "Everyone" is not listed in the "Name" column, this is a finding. - -If "This folder, subfolders and files" is not listed in the "Apply To" column, this is a finding. - -When "Everyone" ... " is listed, select the "Everyone" row and click on the Edit button. - -If either the Successful or Failed checkbox is not selected for any of the following access types, this is a finding: - Traverse folder/execute file - List folder/read data - Read attributes - Read extended attributes - Create files/write data - Create folders/append data - Write attributes - Write extended attributes - Delete - Read permissions - - - - <VulnDiscussion>SQL Server DBAs, if assigned excessive OS privileges, could perform actions that could endanger the information system or hide evidence of malicious activity. - -This requirement is intended to limit exposure due to operating from within a privileged account or role. The check and fix are based on the assumption that Role-Based Access Control (RBAC) is in effect, as mandated by other STIG requirements. They further assume that, as mandated elsewhere, the privileged accounts discussed here are distinct from the accounts used by the same people when not performing privileged functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-40937 - True - False - False - - - From the system security documentation, obtain the list of SQL Server DBA accounts, the OS/domain Group(s) representing those DBAs' job role(s), and the OS permissions required by that/those role(s). - - -To review local accounts and groups: - -Log on to the Windows server hosting SQL Server, using an account with administrator privileges. - -From a command prompt opened as administrator, type gpedit.msc, and press [ENTER]. In Group Policy Editor, navigate to Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment. Scan the list to determine which privileges are assigned to the Group(s) representing the SQL Server DBA job role(s). If any privileges are assigned that are not required by these roles, this is a finding. - -From the command prompt, type lusrmgr.msc, and press [ENTER]. In the Local Users and Groups console, navigate to Users. Right-click each DBA user. Click Properties. Click the 'Member of' tab. If any parent groups are listed that are not specific to DBA roles, this is a finding. - -In the Local Users and Groups console, navigate to Groups. Right-click each DBA Group. Click Properties. Review the list of group members. If any account that does not represent a DBA is listed, this is a finding. - - -To review domain-level accounts and groups: - -Log on to a domain controller with the necessary privileges. - -Open Active Directory Users and Computers (available from menus or run dsa.msc) - -Determine the location of the accounts or groups to be reviewed. The default is the Users container, but they could have been created or moved to an Organizational Unit (OU) that is domain specific. - -Right-click each DBA user. Click Properties. Click the 'Member of' tab. If any parent groups are listed that are not specific to DBA roles, this is a finding. - -Right-click each DBA Group. Click Properties. Select the 'Members' tab. Review the list of group members. If any account that does not represent a DBA is listed, this is a finding. - - - - <VulnDiscussion>This requirement is intended to limit exposure due to operating from within a privileged account or role. The inclusion of role is intended to address those situations where an access control policy, such as Role-Based Access Control (RBAC), is being implemented and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account. - -Audit of privileged activity may require physical separation, employing information systems on which the user does not have privileged access. - -To limit exposure and provide forensic history of activity when operating from within a privileged account or role, SQL Server does support organizational requirements that users of information system accounts, or roles, with access to an organization-defined list of security functions or security-relevant information, use non-privileged accounts, or roles, when accessing other (non-security) system functions. - -SQL Server provides access logging that ensures users who are granted a privileged role (or roles) have their privileged activity logged. DBAs, if assigned excessive privileges, could perform actions that endanger the information system or hide evidence of malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-40937 - True - False - False - - - Obtain the list of all DBAs. -Obtain documented role assignments for each DBA. -Obtain from system documentation or use SQL Server to determine privilege assignment of user-defined roles. - -Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Logins >> right click <'administrator account name'> >> Properties >> User >> Securables. - -If any item in the 'Permission' listing, for each highlighted item that exists in the 'Securables' listing, has excessive privileges, this is a finding. - -Navigate from 'Securables' to 'Server Roles'. - -If any checked 'Server roles' are determined to be excessive privileges, this is a finding. - -Navigate from 'Server Roles' to 'Users mapped to the login'. - -If any checked 'Database role membership' of each highlighted and checked 'Database' are determined to be excessive privileges, this is a finding. - - - - <VulnDiscussion>The principle of Least Privilege must be applied to the ability of users to access system tables, system management information, other configuration information, and metadata. Unauthorized access to this data could result in unauthorized changes to database objects, access controls, or SQL Server configuration. Only database administrators and other authorized users must be allowed such access. - -To aid in tracking and administering such permissions, individual logins must not be directly granted permissions or built-in server roles. Instead, user-defined server roles must be created, with the permissions and built-in server roles granted to them; the individual logins must be assigned to the appropriate user-defined server roles. - -The built-in server role "sysadmin" is a partial exception. This cannot be granted to a user-defined role, only to a login account. Most (not necessarily all) database administrators will need to be members of sysadmin. Without this, most DBCC commands and the system stored procedures/functions listed below are unavailable. The users who require such access must be documented and approved. - -In addition, if the site uses backup-restore software that connects to SQL Server via the Virtual Device Interface (VDI), the account used by that software must have the sysadmin role. (See Microsoft Knowledge Base article 2926557, http://support.microsoft.com/kb/2926557). If this applies, it must be documented and approved. - -Stored procedures/functions available only to the sysadmin role: -fn_yukonsecuritymodelrequired -sp_add_agent_parameter -sp_add_agent_profile -sp_adddatatype -sp_adddistributiondb -sp_adddistributor -sp_addqreader_agent -sp_addsubscriber -sp_addsubscriber_schedule -sp_addtabletocontents -sp_attachsubscription -sp_cdc_cleanup_change_table -sp_cdc_disable_db -sp_cdc_disable_table -sp_cdc_drop_job -sp_cdc_enable_db -sp_cdc_enable_table -sp_cdc_restoredb -sp_cdc_vupgrade -sp_certify_removable -sp_change_agent_parameter -sp_change_agent_profile -sp_change_subscription_properties -sp_change_users_login -sp_changedistpublisher -sp_changedistributiondb -sp_changedistributor_password -sp_changedistributor_property -sp_changemergesubscription -sp_changeqreader_agent -sp_changereplicationserverpasswords -sp_changesubscriptiondtsinfo -sp_checkinvalidivarticle -sp_copysubscription -sp_create_removable -sp_cycle_errorlog -sp_dbcmptlevel -sp_dbmmonitoraddmonitoring -sp_dbmmonitorchangealert -sp_dbmmonitordropalert -sp_dbmmonitordropmonitoring -sp_dbmmonitorhelpalert -sp_dbmmonitorhelpmonitoring -sp_dbmmonitorresults -sp_dbmmonitorupdate -sp_dbremove -sp_drop_agent_parameter -sp_drop_agent_profile -sp_dropdatatypemapping -sp_dropdistpublisher -sp_dropdistributiondb -sp_dropdistributor -sp_dropmergepullsubscription -sp_droppullsubscription -sp_dropsubscriber -sp_dsninfo -sp_enumdsn -sp_flush_commit_table_on_demand -sp_generate_agent_parameter -sp_get_distributor -sp_get_Oracle_publisher_metadata -sp_getagentparameterlist -sp_getdefaultdatatypemapping -sp_grant_publication_access -sp_help_agent_default -sp_help_agent_parameter -sp_help_agent_profile -sp_helpdistpublisher -sp_helpdistributor -sp_helpmergesubscription -sp_helpqreader_agent -sp_helpreplicationdboption -sp_identitycolumnforreplication -sp_IHValidateRowFilter -sp_IHXactSetJob -sp_link_publication -sp_monitor -sp_MSadd_distribution_agent -sp_MSadd_logreader_agent -sp_MSadd_merge_agent -sp_MSadd_snapshot_agent -sp_MSadd_subscriber_schedule -sp_MSadd_tracer_history -sp_MSadd_tracer_token -sp_MScdc_cleanup_job -sp_MScdc_db_ddl_event -sp_MScdc_ddl_event -sp_MSchange_distribution_agent_properties -sp_MSchange_logreader_agent_properties -sp_MSchange_merge_agent_properties -sp_MSchange_snapshot_agent_properties -sp_MSchangedynamicsnapshotjobatdistributor -sp_MSchangedynsnaplocationatdistributor -sp_MScheck_pull_access -sp_MScleanupmergepublisher_internal -sp_MSclear_dynamic_snapshot_location -sp_MScreate_dist_tables -sp_MSdbuserpriv -sp_MSdeletefoldercontents -sp_MSdrop_6x_replication_agent -sp_MSdrop_merge_agent -sp_MSdrop_snapshot_dirs -sp_MSdropmergedynamicsnapshotjob -sp_MSdynamicsnapshotjobexistsatdistributor -sp_MSenumallpublications -sp_MSfetchAdjustidentityrange -sp_MSfix_6x_tasks -sp_MSforce_drop_distribution_jobs -sp_MSget_agent_names -sp_MSget_jobstate -sp_MSget_oledbinfo -sp_MSget_publication_from_taskname -sp_MSgetdbversion -sp_MSgetmaxsnapshottimestamp -sp_MShelp_repl_agent -sp_MShelp_replication_status -sp_MShelp_snapshot_agent -sp_MShelpconflictpublications -sp_MShelpdynamicsnapshotjobatdistributor -sp_MShelplogreader_agent -sp_MShelpsnapshot_agent -sp_MShelptranconflictcounts -sp_MSinit_publication_access -sp_MSreinit_failed_subscriptions -sp_MSremoveoffloadparameter -sp_MSrepl_backup_complete -sp_MSrepl_backup_start -sp_MSrepl_createdatatypemappings -sp_MSrepl_dropdatatypemappings -sp_MSrepl_enumarticlecolumninfo -sp_MSrepl_enumpublications -sp_MSrepl_enumpublishertables -sp_MSrepl_enumsubscriptions -sp_MSrepl_enumtablecolumninfo -sp_MSrepl_getdistributorinfo -sp_MSrepl_startup_internal -sp_MSreplagentjobexists -sp_MSreplcheck_permission -sp_MSreplcheck_pull -sp_MSreplcheck_subscribe -sp_MSreplcheck_subscribe_withddladmin -sp_MSreplcopyscriptfile -sp_MSreplremoveuncdir -sp_MSsetalertinfo -sp_MSSetServerProperties -sp_MSsetupnosyncsubwithlsnatdist -sp_MSsetupnosyncsubwithlsnatdist_cleanup -sp_MSsetupnosyncsubwithlsnatdist_helper -sp_MSstartdistribution_agent -sp_MSstartmerge_agent -sp_MSstartsnapshot_agent -sp_MSstopdistribution_agent -sp_MSstopmerge_agent -sp_MSstopsnapshot_agent -sp_MSupdate_agenttype_default -sp_oledbinfo -sp_procoption -sp_removedbreplication -sp_removesrvreplication -sp_replication_agent_checkup -sp_replicationdboption -sp_resetstatus -sp_restoredbreplication -sp_SetAutoSAPasswordAndDisable -sp_setdefaultdatatypemapping -sp_updatestats -sp_validatelogins -sp_vupgrade_mergeobjects -sp_vupgrade_replication -sp_vupgrade_replsecurity_metadata -xp_repl_convert_encrypt_sysadmin_wrapper -</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-40937 - True + +Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. + +SQL Server's 'Alter any connection' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any connection' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. + +Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. + +The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + False False - - Use SQL Server and system documentation to determine privilege assignment of user-defined roles. + Obtain the list of roles that are authorized for the SQL Server 'Alter any connection' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -Determine which user-defined roles grant privileges to system tables and configuration data stored in SQL Server. +SELECT + who.name AS [Principal Name], + who.type_desc AS [Principal Type], + who.is_disabled AS [Principal Is Disabled], + what.state_desc AS [Permission State], + what.permission_name AS [Permission Name] +FROM + sys.server_permissions what + INNER JOIN sys.server_principals who + ON who.principal_id = what.grantee_principal_id +WHERE + what.permission_name = 'Alter any connection' +AND who.type_desc = 'SERVER_ROLE' +ORDER BY + who.name +; +GO -For each Login: +If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. + + + <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. -In SQL Server Management Studio, Object Explorer, expand <SQL Server instance> >> Security >> Logins >> Right-click <login account name> >> Properties >> User >> Securables. +Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. -If any item in the Explicit Permissions listing, for each highlighted item that exists in the Securables listing, indicates direct permission access, and that permission is anything other than Connect SQL, this is a finding. +SQL Server's 'Alter any credential' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any credential' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. -Navigate from Securables to Server Roles. +Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. -If any Server Roles are checked from the following list, indicating direct permission access, this is a finding: -bulkadmin -dbcreator -diskadmin -processadmin -securityadmin -serveradmin -setupadmin +The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain the list of roles that are authorized for the SQL Server 'Alter any credential' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -If the sysadmin server role is checked, review system documentation to determine whether this login's need for the sysadmin role is documented and approved. If it is not, this is a finding. +SELECT + who.name AS [Principal Name], + who.type_desc AS [Principal Type], + who.is_disabled AS [Principal Is Disabled], + what.state_desc AS [Permission State], + what.permission_name AS [Permission Name] +FROM + sys.server_permissions what + INNER JOIN sys.server_principals who + ON who.principal_id = what.grantee_principal_id +WHERE + what.permission_name = 'Alter any credential' +AND who.type_desc = 'SERVER_ROLE' +ORDER BY + who.name +; +GO -If any user-defined server roles with system table or configuration data privileges are checked, review system documentation to determine whether this login's need for the role is documented and approved. If it is not, this is a finding. +If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. + + + <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. -Navigate from Server Roles to User Mapping. Select in turn each entry where the User column is non-blank. If any Database Roles are checked from the following list, indicating direct permission access, this is a finding: -db_accessadmin -db_backupoperator -db_datareader -db_datawriter -db_ddladmin -db_denydatareader -db_denydatawriter -db_owner -db_securityadmin +Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. + +SQL Server's 'Alter any database' permission is a high server-level privilege that must only be granted to individual administration accounts through roles If the 'Alter any database' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. + +Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. + +The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain the list of roles that are authorized for the SQL Server 'Alter any database' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: + +SELECT + who.name AS [Principal Name], + who.type_desc AS [Principal Type], + who.is_disabled AS [Principal Is Disabled], + what.state_desc AS [Permission State], + what.permission_name AS [Permission Name] +FROM + sys.server_permissions what + INNER JOIN sys.server_principals who + ON who.principal_id = what.grantee_principal_id +WHERE + what.permission_name = 'Alter any database' +AND who.type_desc = 'SERVER_ROLE' +ORDER BY + who.name +; +GO + +If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. + + + <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. + +Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. + +SQL Server's 'Alter any endpoint' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any endpoint' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. + +Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. + +The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain the list of roles that are authorized for the SQL Server 'Alter any endpoint' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: + +SELECT + who.name AS [Principal Name], + who.type_desc AS [Principal Type], + who.is_disabled AS [Principal Is Disabled], + what.state_desc AS [Permission State], + what.permission_name AS [Permission Name] +FROM + sys.server_permissions what + INNER JOIN sys.server_principals who + ON who.principal_id = what.grantee_principal_id +WHERE + what.permission_name = 'Alter any endpoint' +AND who.type_desc = 'SERVER_ROLE' +ORDER BY + who.name +; +GO + +If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. + + + <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. + +Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. + +SQL Server's 'Alter any event session' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any event session' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. + +Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. + +The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain the list of roles that are authorized for the SQL Server 'Alter any event session' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: + +SELECT + who.name AS [Principal Name], + who.type_desc AS [Principal Type], + who.is_disabled AS [Principal Is Disabled], + what.state_desc AS [Permission State], + what.permission_name AS [Permission Name] +FROM + sys.server_permissions what + INNER JOIN sys.server_principals who + ON who.principal_id = what.grantee_principal_id +WHERE + what.permission_name = 'Alter any event session' +AND who.type_desc = 'SERVER_ROLE' +ORDER BY + who.name +; +GO + +If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. + + + <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. + +Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. + +SQL Server's 'Alter server state' permission is a high server-level privilege that must only be granted to individual administration accounts through roles, and users who have access must require this privilege to accomplish the organizational missions and/or functions. If the 'Alter server state' permissions are granted to roles that are unauthorized to have this privilege, then this access must be removed. + +Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. + +The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain the list of roles that are authorized for the SQL Server 'Alter server state' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. + +Obtain the list of roles with that permission by running the following query: + +SELECT + who.name AS [Principal Name], + who.type_desc AS [Principal Type], + who.is_disabled AS [Principal Is Disabled], + what.state_desc AS [Permission State], + what.permission_name AS [Permission Name] +FROM + sys.server_permissions what + INNER JOIN sys.server_principals who + ON who.principal_id = what.grantee_principal_id +WHERE + what.permission_name = 'Alter server state' +AND who.type_desc = 'SERVER_ROLE' +ORDER BY + who.name +; +GO + +If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. + + + <VulnDiscussion>Backup and recovery of the Service Master Key may be critical to the complete recovery of the database. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review procedures for, and evidence of backup of, the SQL Server Service Master Key in the System Security Plan. + +If the procedures or evidence do not exist, this is a finding. + +If the procedures do not indicate offline and off-site storage of the Service Master Key, this is a finding. + +If procedures do not indicate access restrictions to the Service Master Key backup, this is a finding. + + + <VulnDiscussion>Separate accounts used to manage the SQL Server platform help prevent a lateral move within an environment if SQL were to be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine the accounts being used to manage the SQL Server operating system. Determine whether the same accounts are being used to manage other platforms. If the same account is used to manage more than one platform, this is a finding. +Note: If, because of the application configuration, there are multiple instances of SQL that would share a given exploit, a single account would be allowed to be used for the group and would not be considered a finding. + - - + <VulnDiscussion>Default database file locations should be protected from unauthorized access. The system databases, essential to SQL Server operation, are typically located here.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-40937 - True + False False - Obtain the SQL Server default data directory location: from a command prompt, open the registry editor by typing regedit.exe, and pressing [ENTER]. Navigate to the following registry location: HKEY_LOCAL_MACHINE >> SOFTWARE @@ -4661,24 +4495,49 @@ Note 2: Tips for adding a service SID/virtual account to a folder's permission l 8) Click OK 9) Permission like a normal user from here -Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only. +Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only. + +Note 4: It may also be necessary to grant the SQL Server Agent permission to Delete the \Log directory and its contents. This is not a finding. + + + <VulnDiscussion>Database files must be protected from unauthorized access. Although default data locations are created at installation time, sites can, and will, use other directories for site-created database files to comply with best practices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain the SQL Server data directory location(s): in a tool such as SQL Server Management Studio, run the statement: +SELECT DISTINCT +LEFT(physical_name, (LEN(physical_name) - CHARINDEX('\',REVERSE(physical_name)) + 1 )) +AS "Database Data File Paths", +type_desc +FROM sys.master_files +WHERE database_id > 4 +AND type = 0 + +The query result is a list of file systems locations used for databases other than the system databases. Navigate to each of those folder locations using a command prompt or Windows Explorer. The following instructions assume that Windows Explorer is used. -Note 4: It may also be necessary to grant the SQL Server Agent permission to Delete the \Log directory and its contents. This is not a finding. + +Verify that the identified folders and their contents have only authorized privileges. Right-click each folder, click Properties. On the Security tab, verify that at most the following permissions are present: +CREATOR OWNER (Full Control) +System (Full control) +SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] +System Administrators (Full Control) [Note 3] +SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read & Execute) [Notes 1, 2] +SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] +SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Write) [Notes 1, 2] +If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. - - + <VulnDiscussion>Backups must be protected from unauthorized deletion and modification. They must also be protected from unauthorized use in database restoration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-40937 - True + False False - - Obtain the SQL Server backup directory location: from a command prompt, open the registry editor by typing regedit.exe, and pressing [ENTER]. Navigate to the following registry location: -HKEY_LOCAL_MACHINE ->> SOFTWARE + Obtain the SQL Server backup directory location: from a command prompt, open the registry editor by typing regedit.exe, and pressing [ENTER]. Navigate to the following registry location: +HKEY_LOCAL_MACHINE +>> SOFTWARE >> Microsoft ->> Microsoft SQL Server +>> Microsoft SQL Server >> [INSTANCE NAME] >> MSSQLServer >> BackupDirectory @@ -4692,9 +4551,9 @@ Navigate to each folder location using a command prompt or Windows Explorer. Th Verify that backup files and folders have only authorized privileges. Right-click the backup folder, click Properties. On the Security tab, verify that at most the following permissions are present: CREATOR OWNER (Full Control) System (Full control) -SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] -SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] -SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Write) [Notes 1, 2] +SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] +SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) [Notes 1, 2] +SQL Server FD Launcher Service SID OR Service Account, if full-text indexing is in use. (Read, Write) [Notes 1, 2] System Administrators (Full Control) [Note 3] SQL Server Analysis Services (SSAS) Service SID or Service Account, if SSAS is in use (Read & Execute) [Notes 1, 2] If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. @@ -4725,7 +4584,107 @@ Note 2: Tips for adding a service SID/virtual account to a folder's permission l Note 3: In the interest of separation of responsibilities with least privilege, consider granting Full Control only to SQL Database Administrators (create a custom group for these) and providing the local Administrators group with Read access only. - + + <VulnDiscussion>Use of privileged accounts for non-administrative purposes puts data at risk of unintended or unauthorized loss, modification, or exposure. In particular, DBA accounts, if used for non-administration application development or application maintenance, can lead to excessive privileges where privileges are inherited by object owners. It may also lead to loss or compromise of application data where the elevated privileges bypass controls designed in and provided by applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review procedures and practices. If there is not a policy requiring owners of privileged accounts to use non-privileged accounts for non-administrative activities, this is a finding. If there is evidence that owners of privileged accounts do not adhere to this policy, this is a finding. + + + <VulnDiscussion>The concept of least privilege must be applied to SQL Server processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and SQL Server accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of SQL Server and the OS. + +Unauthorized access to sensitive data or SQL Server control may compromise the confidentiality of personnel privacy, threaten national security, compromise a variety of other sensitive operations, or lead to a loss of system control. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user. + +SQL Server's 'Alter any event notification' permission is a high server-level privilege that must only be granted to individual administration accounts through roles. If the 'Alter any event notification' permission is granted to roles that are unauthorized to have this privilege, then this access must be removed. + +Additionally, the permission must not be denied to a role, because that could disable a user's legitimate access via another role. + +The fix for this vulnerability specifies the use of REVOKE. Be aware that revoking a permission that is currently denied to a role or user does not necessarily disable the permission. If the user or role can inherent the permission from another role, revoking the denied permission from the user or the first role can effectively enable the inherited permission.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain the list of roles that are authorized for the SQL Server 'Alter any event notification' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: + +SELECT +who.name AS [Principal Name], +who.type_desc AS [Principal Type], +who.is_disabled AS [Principal Is Disabled], +what.state_desc AS [Permission State], +what.permission_name AS [Permission Name] +FROM +sys.server_permissions what +INNER JOIN sys.server_principals who +ON who.principal_id = what.grantee_principal_id +WHERE +what.permission_name = 'Alter any event notification' +AND who.type_desc = 'SERVER_ROLE' +ORDER BY +who.name +; +GO + + + + + + + + + Everyone + + + This folder subfolders and files + Traverse,ExecuteFile,ListDirectory,ReadData,ReadAttributes,ReadExtendedAttributes,CreateFiles,WriteData,CreateDirectories,AppendData,WriteAttributes,WriteExtendedAttributes,Delete,ReadPermissions + + + <VulnDiscussion>Any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. + +Accordingly, only qualified and authorized individuals are allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. + +Access restrictions for change also include software libraries. + +Examples of access restrictions include: physical access controls (such as locks and access cards), logical access controls (such as ACLs), automated auditing (logging) of logical access, workflow automation, media libraries, abstract layers (e.g., changes are implemented into a third-party interface rather than directly into the information system component), and change windows (e.g., changes occur only during specified times, making unauthorized changes outside the window easy to discover). + +This requirement focuses on the auditing aspect of the protections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>true</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + True + the correct path is specified and does NOT conflict with RuleId V-69169 + + + Verify that Files and Folders that are part of the SQL Server 2012 Installation have auditing enabled. + +Right click the root folder of the SQL Server installation. Typically, this is at <drive>:\Program Files\Microsoft SQL Server\. Select Properties. + +Click on the Security tab + +Click on the Advanced button + +Click on the Auditing tab + +If "Everyone" is not listed in the "Name" column, this is a finding. + +If "This folder, subfolders and files" is not listed in the "Apply To" column, this is a finding. + +When "Everyone" ... " is listed, select the "Everyone" row and click on the Edit button. + +If either the Successful or Failed checkbox is not selected for any of the following access types, this is a finding: + Traverse folder/execute file + List folder/read data + Read attributes + Read extended attributes + Create files/write data + Create folders/append data + Write attributes + Write extended attributes + Delete + Read permissions + + @@ -4742,12 +4701,13 @@ Note 3: In the interest of separation of responsibilities with least privilege, Unmanaged changes that occur to the software libraries or configuration can lead to unauthorized or compromised installations. Of particular note in this context is that any software installed for auditing and/or audit file management must be protected and audited.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-40950 + False False True - - + the correct path is specified and does NOT conflict with RuleId V-40950 + + Obtain the SQL Server software directory location: from a command prompt, open the registry editor by typing regedit.exe and pressing [ENTER]. Navigate to the following registry location: HKEY_LOCAL_MACHINE >> SOFTWARE @@ -4759,7 +4719,7 @@ HKEY_LOCAL_MACHINE Determine the location of separate but related softare, such as audit file management tools. -Verify that files and folders that are part of, or related to, the SQL Server 2012 installation have auditing enabled. Right-click on the file/folder, click Properties. On the Security tab, click Advanced. On the Auditing tab, verify +Verify that files and folders that are part of, or related to, the SQL Server 2012 installation have auditing enabled. Right-click on the file/folder, click Properties. On the Security tab, click Advanced. On the Auditing tab, verify that the following is set up on at least one audit: Type: All Principal: Everyone @@ -4787,8 +4747,8 @@ Some applications that run on SQL Server require the 'sa' account to be enabled USE MASTER GO -SELECT name, is_disabled -FROM sys.sql_logins +SELECT name, is_disabled +FROM sys.sql_logins WHERE principal_id = 1; Verify that the "name" column contains the current name of the sa database server account (see note). @@ -4861,17 +4821,17 @@ From the query prompt: SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. -Determine the trace(s) being used for the auditing requirement. +Determine the trace(s) being used for the auditing requirement. In the following, replace # with a trace ID being used for the auditing requirements. From the query prompt: SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, + 14, 15, 18, 20, + 102, 103, 104, 105, 106, 107, 108, 109, 110, + 111, 112, 113, 115, 116, 117, 118, + 128, 129, 130, + 131, 132, 133, 134, 135, + 152, 153, 170, 171, 172, 173, 175, 176, 177, 178. If any of the audit event IDs required above is not listed, this is a finding. @@ -4879,9 +4839,9 @@ Notes: 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. 3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) +4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; + SELECT * FROM sys.trace_events; 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding. BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount > 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END @@ -4911,7 +4871,7 @@ All currently defined traces for the SQL Server instance will be listed. If no t Determine the trace being used for the auditing requirement. Replace # in the following code with a traceid being used for the auditing requirements. From the query prompt, determine whether the trace options include the value 4, which means SHUTDOWN_ON_ERROR: -SELECT CAST(value AS INT) +SELECT CAST(value AS INT) FROM sys.fn_trace_getinfo(#) where property = 1; @@ -4921,15 +4881,15 @@ If a value is returned but is not 4 or 6, this is a finding. NOTE: Microsoft has flagged the trace techniques and tools used in this STIG as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use and configured to satisfy this requirement, this is not a finding. The following code can be used to check Extended Events settings. -/********************************** +/********************************** Check to verify shutdown on failure is set. -The following settings are what should be returned: -name = <name of audit> -on_failure = 1 -on_failure_desc = SHUTDOWN SERVER INSTANCE -**********************************/ -SELECT name, on_failure, on_failure_desc -FROM sys.server_audits +The following settings are what should be returned: +name = <name of audit> +on_failure = 1 +on_failure_desc = SHUTDOWN SERVER INSTANCE +**********************************/ +SELECT name, on_failure, on_failure_desc +FROM sys.server_audits DECLARE @new_trace_id INT; DECLARE @traceid INT; SET @traceId = (SELECT traceId FROM ::fn_trace_getinfo(NULL) WHERE Value = 6) EXECUTE master.dbo.sp_trace_create @results = @new_trace_id OUTPUT, @options = 6, @traceFilePath = N'$(TraceFilePath)' DECLARE @traceId int SET @traceId = (SELECT traceId FROM ::fn_trace_getinfo(NULL) WHERE Value = 6) IF (@traceId IS NULL) SELECT traceId FROM ::fn_trace_getinfo(NULL) ELSE Print NULL @@ -4947,12 +4907,12 @@ After the initial setup of SQL Server audit log configuration, it is best to che False True - Check the SQL Server audit setting on the maximum number of files of the trace used for the auditing requirement. + Check the SQL Server audit setting on the maximum number of files of the trace used for the auditing requirement. -Select * from sys.traces. Determine the audit being used to fulfill the overall auditing requirement. Examine the max_files and max_size parameters. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost. +Select * from sys.traces. Determine the audit being used to fulfill the overall auditing requirement. Examine the max_files and max_size parameters. SQL will overwrite the oldest files when the max_files parameter has been exceeded. Care must be taken to ensure that this does not happen, or data will be lost. -The amount of space determined for logging by SQL Server is calculated by multiplying the maximum number of files by the maximum file size. +The amount of space determined for logging by SQL Server is calculated by multiplying the maximum number of files by the maximum file size. If auditing will outgrow the space reserved for logging before being overwritten, this is a finding. DECLARE @new_trace_id INT; DECLARE @maxsize bigint DECLARE @maxRolloverFiles int DECLARE @traceId int DECLARE @traceFilePath nvarchar(500) SET @traceFilePath = N'$(TraceFilePath)' SET @traceId = (Select Id from sys.traces where path LIKE (@traceFilePath + '%')) SET @maxsize = $(MaxTraceFileSize) SET @maxRolloverFiles = $(MaxRollOverFileCount) EXEC sp_trace_setstatus @traceid, @status = 2 EXECUTE master.dbo.sp_trace_create @new_trace_id OUTPUT, 6, @traceFilePath, @maxsize, NULL, @maxRolloverFiles DECLARE @traceFilePath nvarchar(500) DECLARE @desiredFileSize bigint DECLARE @desiredMaxFiles int DECLARE @currentFileSize bigint DECLARE @currentMaxFiles int SET @traceFilePath = N'$(TraceFilePath)' SET @currentFileSize = (SELECT max_size from sys.traces where path LIKE (@traceFilePath + '%')) SET @currentMaxFiles = (SELECT max_files from sys.traces where path LIKE (@traceFilePath + '%')) IF (@currentFileSize != $(MaxTraceFileSize)) BEGIN PRINT 'file size not in desired state' SELECT max_size from sys.traces where path LIKE (@traceFilePath + '%') END IF (@currentMaxFiles != $(MaxRollOverFileCount)) BEGIN PRINT 'max files not in desired state'SELECT max_files from sys.traces where path LIKE (@traceFilePath + '%') END @@ -4975,17 +4935,17 @@ From the query prompt: SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. -Determine the trace(s) being used for the auditing requirement. +Determine the trace(s) being used for the auditing requirement. In the following, replace # with a trace ID being used for the auditing requirements. From the query prompt: SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, + 14, 15, 18, 20, + 102, 103, 104, 105, 106, 107, 108, 109, 110, + 111, 112, 113, 115, 116, 117, 118, + 128, 129, 130, + 131, 132, 133, 134, 135, + 152, 153, 170, 171, 172, 173, 175, 176, 177, 178. If any of the audit event IDs required above is not listed, this is a finding. @@ -4993,9 +4953,9 @@ Notes: 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. 3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) +4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; + SELECT * FROM sys.trace_events; 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding. BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount > 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END @@ -5004,7 +4964,7 @@ Use the following query to obtain a list of all event IDs, and their meaning: - <VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. + <VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. Database software is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly who performed a given action. If user identification information is not recorded and stored with the audit record, the record itself is of very limited use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> V-41021 @@ -5017,17 +4977,17 @@ From the query prompt: SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. -Determine the trace(s) being used for the auditing requirement. +Determine the trace(s) being used for the auditing requirement. In the following, replace # with a trace ID being used for the auditing requirements. From the query prompt: SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, + 14, 15, 18, 20, + 102, 103, 104, 105, 106, 107, 108, 109, 110, + 111, 112, 113, 115, 116, 117, 118, + 128, 129, 130, + 131, 132, 133, 134, 135, + 152, 153, 170, 171, 172, 173, 175, 176, 177, 178. If any of the audit event IDs required above is not listed, this is a finding. @@ -5035,9 +4995,9 @@ Notes: 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. 3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) +4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; + SELECT * FROM sys.trace_events; 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding. BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount > 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END @@ -5046,7 +5006,7 @@ Use the following query to obtain a list of all event IDs, and their meaning: - <VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. + <VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know the outcome of attempted actions. This requires specific information regarding the outcome of the action or event that the audit record is referring to. If outcome status information is not recorded and stored with the audit record, the record itself is of very limited use. @@ -5063,17 +5023,17 @@ From the query prompt: SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. -Determine the trace(s) being used for the auditing requirement. +Determine the trace(s) being used for the auditing requirement. In the following, replace # with a trace ID being used for the auditing requirements. From the query prompt: SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, + 14, 15, 18, 20, + 102, 103, 104, 105, 106, 107, 108, 109, 110, + 111, 112, 113, 115, 116, 117, 118, + 128, 129, 130, + 131, 132, 133, 134, 135, + 152, 153, 170, 171, 172, 173, 175, 176, 177, 178. If any of the audit event IDs required above is not listed, this is a finding. @@ -5081,9 +5041,9 @@ Notes: 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. 3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) +4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; + SELECT * FROM sys.trace_events; 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding. BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount > 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END @@ -5092,7 +5052,7 @@ Use the following query to obtain a list of all event IDs, and their meaning: - <VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. + <VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly who performed what actions. This requires specific information regarding the source of the event an audit record is referring to. If the source of the event information is not recorded and stored with the audit record, the record itself is of very limited use. @@ -5107,17 +5067,17 @@ From the query prompt: SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. -Determine the trace(s) being used for the auditing requirement. +Determine the trace(s) being used for the auditing requirement. In the following, replace # with a trace ID being used for the auditing requirements. From the query prompt: SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, + 14, 15, 18, 20, + 102, 103, 104, 105, 106, 107, 108, 109, 110, + 111, 112, 113, 115, 116, 117, 118, + 128, 129, 130, + 131, 132, 133, 134, 135, + 152, 153, 170, 171, 172, 173, 175, 176, 177, 178. If any of the audit event IDs required above is not listed, this is a finding. @@ -5125,9 +5085,9 @@ Notes: 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. 3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) +4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; + SELECT * FROM sys.trace_events; 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding. BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount > 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END @@ -5136,7 +5096,7 @@ Use the following query to obtain a list of all event IDs, and their meaning: - <VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. + <VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly where actions were performed. This requires specific information regarding the event location an audit record is referring to. If event location information is not recorded and stored with the audit record, the record itself is of very limited use. @@ -5151,17 +5111,17 @@ From the query prompt: SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. -Determine the trace(s) being used for the auditing requirement. +Determine the trace(s) being used for the auditing requirement. In the following, replace # with a trace ID being used for the auditing requirements. From the query prompt: SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, + 14, 15, 18, 20, + 102, 103, 104, 105, 106, 107, 108, 109, 110, + 111, 112, 113, 115, 116, 117, 118, + 128, 129, 130, + 131, 132, 133, 134, 135, + 152, 153, 170, 171, 172, 173, 175, 176, 177, 178. If any of the audit event IDs required above is not listed, this is a finding. @@ -5169,9 +5129,9 @@ Notes: 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. 3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) +4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; + SELECT * FROM sys.trace_events; 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding. BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount > 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END @@ -5180,7 +5140,7 @@ Use the following query to obtain a list of all event IDs, and their meaning: - <VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. + <VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly when actions were performed. This requires specific information regarding the date and time an audit record is referring to. If date and time information is not recorded and stored with the audit record, the record itself is of very limited use. @@ -5195,17 +5155,17 @@ From the query prompt: SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. -Determine the trace(s) being used for the auditing requirement. +Determine the trace(s) being used for the auditing requirement. In the following, replace # with a trace ID being used for the auditing requirements. From the query prompt: SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, + 14, 15, 18, 20, + 102, 103, 104, 105, 106, 107, 108, 109, 110, + 111, 112, 113, 115, 116, 117, 118, + 128, 129, 130, + 131, 132, 133, 134, 135, + 152, 153, 170, 171, 172, 173, 175, 176, 177, 178. If any of the audit event IDs required above is not listed, this is a finding. @@ -5213,9 +5173,9 @@ Notes: 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. 3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) +4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; + SELECT * FROM sys.trace_events; 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding. BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount > 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END @@ -5224,7 +5184,7 @@ Use the following query to obtain a list of all event IDs, and their meaning: - <VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. + <VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly what actions were performed. This requires specific information regarding the event type an audit record is referring to. If event type information is not recorded and stored with the audit record, the record itself is of very limited use. @@ -5239,17 +5199,17 @@ From the query prompt: SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. -Determine the trace(s) being used for the auditing requirement. +Determine the trace(s) being used for the auditing requirement. In the following, replace # with a trace ID being used for the auditing requirements. From the query prompt: SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, + 14, 15, 18, 20, + 102, 103, 104, 105, 106, 107, 108, 109, 110, + 111, 112, 113, 115, 116, 117, 118, + 128, 129, 130, + 131, 132, 133, 134, 135, + 152, 153, 170, 171, 172, 173, 175, 176, 177, 178. If any of the audit event IDs required above is not listed, this is a finding. @@ -5257,9 +5217,9 @@ Notes: 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. 3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) +4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; + SELECT * FROM sys.trace_events; 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding. BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount > 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END @@ -5285,17 +5245,17 @@ From the query prompt: SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. -Determine the trace(s) being used for the auditing requirement. +Determine the trace(s) being used for the auditing requirement. In the following, replace # with a trace ID being used for the auditing requirements. From the query prompt: SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, + 14, 15, 18, 20, + 102, 103, 104, 105, 106, 107, 108, 109, 110, + 111, 112, 113, 115, 116, 117, 118, + 128, 129, 130, + 131, 132, 133, 134, 135, + 152, 153, 170, 171, 172, 173, 175, 176, 177, 178. If any of the audit event IDs required above is not listed, this is a finding. @@ -5303,9 +5263,9 @@ Notes: 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. 3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) +4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; + SELECT * FROM sys.trace_events; 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding. BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount > 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END @@ -5393,18 +5353,18 @@ Note that this does not apply to logins with names of the form '##MS...##'. Thes Obtain the list of accounts that have direct access to the server-level permission 'Alter any endpoint' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Alter any endpoint' + what.permission_name = 'Alter any endpoint' AND who.name NOT LIKE '##MS%##' AND who.type_desc <> 'SERVER_ROLE' ORDER BY @@ -5415,14 +5375,14 @@ GO If any user accounts have direct access to the 'Alter any endpoint' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -5488,18 +5448,18 @@ Note that this does not apply to logins with names of the form '##MS...##'. Thes Obtain the list of accounts that have direct access to the server-level permission 'Alter any database' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Alter any database' + what.permission_name = 'Alter any database' AND who.name NOT LIKE '##MS%##' AND who.type_desc <> 'SERVER_ROLE' ORDER BY @@ -5510,14 +5470,14 @@ GO If any user accounts have direct access to the 'Alter any database' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -5583,18 +5543,18 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Alter any credential' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Alter any credential' + what.permission_name = 'Alter any credential' AND who.name NOT LIKE '##MS%##' AND who.type_desc <> 'SERVER_ROLE' ORDER BY @@ -5605,14 +5565,14 @@ GO If any user accounts have direct access to the 'Alter any credential' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -5678,18 +5638,18 @@ Note that this does not apply to logins with names of the form '##MS...##'. Thes Obtain the list of accounts that have direct access to the server-level permission 'Alter any connection' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Alter any connection' + what.permission_name = 'Alter any connection' AND who.name NOT LIKE '##MS%##' AND who.type_desc <> 'SERVER_ROLE' ORDER BY @@ -5700,14 +5660,14 @@ GO If any user accounts have direct access to the 'Alter any connection' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -5773,14 +5733,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Alter server state' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -5795,14 +5755,14 @@ GO If any user accounts have direct access to the 'Alter server state' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -5868,14 +5828,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Alter any event notification' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -5890,14 +5850,14 @@ GO If any user accounts have direct access to the 'Alter any event notification' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -5963,35 +5923,35 @@ The fix for this vulnerability specifies the use of REVOKE. Be aware that revok Obtain the list of roles that are authorized for the SQL Server 'View any database' permission and what 'Grant', 'Grant With', and/or 'Deny' privilege is authorized. Obtain the list of roles with that permission by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'View any database' + what.permission_name = 'View any database' AND who.type_desc = 'SERVER_ROLE' ORDER BY who.name ; -GO +GO If any role has 'Grant', 'With Grant' or 'Deny' privileges on this permission and users with that role are not authorized to have the permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6056,18 +6016,18 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Alter any server audit' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Alter any server audit' + what.permission_name = 'Alter any server audit' AND who.name NOT LIKE '##MS%##' AND who.type_desc <> 'SERVER_ROLE' ORDER BY @@ -6078,14 +6038,14 @@ GO If any user accounts have direct access to the 'Alter any server audit' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6151,14 +6111,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Authenticate Server' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6173,14 +6133,14 @@ GO If any user accounts have direct access to the 'Authenticate Server' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6246,14 +6206,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Administer bulk operations' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6268,14 +6228,14 @@ GO If any user accounts have direct access to the 'Administer bulk operations' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6341,14 +6301,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Create endpoint' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6363,14 +6323,14 @@ GO If any user accounts have direct access to the 'Create endpoint' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6447,7 +6407,7 @@ sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE -what.permission_name = 'Create DDL Event Notification' +what.permission_name = 'Create DDL Event Notification' AND who.name NOT LIKE '##MS%##' AND who.type_desc <> 'SERVER_ROLE' ORDER BY @@ -6458,14 +6418,14 @@ GO If any user accounts have direct access to the 'Create DDL Event Notification' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6532,14 +6492,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Create availability group' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6554,14 +6514,14 @@ GO If any user accounts have direct access to the 'Create availability group' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6627,14 +6587,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Create any database' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6649,14 +6609,14 @@ GO If any user accounts have direct access to the 'Create any database' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6722,14 +6682,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Control server' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6744,14 +6704,14 @@ GO If any user accounts have direct access to the 'Control server' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6817,14 +6777,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Alter any linked server' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6839,14 +6799,14 @@ GO If any user accounts have direct access to the 'Alter any linked server' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6912,14 +6872,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Alter any event session' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -6934,14 +6894,14 @@ GO If any user accounts have direct access to the 'Alter any event session' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7007,14 +6967,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Alter trace' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7029,14 +6989,14 @@ GO If any user accounts have direct access to the 'Alter trace' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7102,14 +7062,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Alter Settings' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7124,14 +7084,14 @@ GO If any user accounts have direct access to the 'Alter Settings' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7197,18 +7157,18 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Create trace event notification' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Create trace event notification' + what.permission_name = 'Create trace event notification' AND who.name NOT LIKE '##MS%##' AND who.type_desc <> 'SERVER_ROLE' ORDER BY @@ -7219,14 +7179,14 @@ GO If any user accounts have direct access to the 'Create trace event notification' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7292,14 +7252,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Alter resources' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7314,14 +7274,14 @@ GO If any user accounts have direct access to the 'Alter resources' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7387,14 +7347,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'External access assembly' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7409,14 +7369,14 @@ GO If any user accounts have direct access to the 'External access assembly' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7482,14 +7442,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Alter any login' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7504,14 +7464,14 @@ GO If any user accounts have direct access to the 'Alter any login' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7577,18 +7537,18 @@ Note that this does not apply to logins with names of the form '##MS...##'. Thes Obtain the list of accounts that have direct access to the server-level permission 'Shutdown' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE - what.permission_name = 'Shutdown' + what.permission_name = 'Shutdown' AND who.name NOT LIKE '##MS%##' AND who.type_desc <> 'SERVER_ROLE' ORDER BY @@ -7599,14 +7559,14 @@ GO If any user accounts have direct access to the 'Shutdown' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7672,14 +7632,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Unsafe assembly' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7694,14 +7654,14 @@ GO If any user accounts have direct access to the 'Unsafe assembly' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7767,14 +7727,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. Thes Obtain the list of accounts that have direct access to the server-level permission 'Create server role' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7789,14 +7749,14 @@ GO If any user accounts have direct access to the 'Create server role' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7862,14 +7822,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'View server state' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7884,14 +7844,14 @@ GO If any user account has direct access to the 'View server state' permission, and the need for this has not been documented and approved, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7957,14 +7917,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'Alter any server role' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -7979,14 +7939,14 @@ GO If any user accounts have direct access to the 'Alter any server role' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -8052,14 +8012,14 @@ Note that this does not apply to logins with names of the form '##MS...##'. The Obtain the list of accounts that have direct access to the server-level permission 'View any definition' by running the following query: -SELECT +SELECT who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled], what.state_desc AS [Permission State], what.permission_name AS [Permission Name] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -8074,14 +8034,14 @@ GO If any user accounts have direct access to the 'View any definition' permission, this is a finding. Alternatively, to provide a combined list for all requirements of this type: -SELECT +SELECT what.permission_name AS [Permission Name], what.state_desc AS [Permission State], who.name AS [Principal Name], who.type_desc AS [Principal Type], who.is_disabled AS [Principal Is Disabled] -FROM - sys.server_permissions what +FROM + sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE @@ -8146,17 +8106,17 @@ From the query prompt: SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. -Determine the trace(s) being used for the auditing requirement. +Determine the trace(s) being used for the auditing requirement. In the following, replace # with a trace ID being used for the auditing requirements. From the query prompt: SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, + 14, 15, 18, 20, + 102, 103, 104, 105, 106, 107, 108, 109, 110, + 111, 112, 113, 115, 116, 117, 118, + 128, 129, 130, + 131, 132, 133, 134, 135, + 152, 153, 170, 171, 172, 173, 175, 176, 177, 178. If any of the audit event IDs required above is not listed, this is a finding. @@ -8164,9 +8124,9 @@ Notes: 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. 3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) +4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; + SELECT * FROM sys.trace_events; 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding. BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount > 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END @@ -8175,11 +8135,11 @@ Use the following query to obtain a list of all event IDs, and their meaning: - <VulnDiscussion>Once an attacker establishes initial access to a system, they often attempt to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply modify an existing account. + <VulnDiscussion>Once an attacker establishes initial access to a system, they often attempt to create a persistent method of re-establishing access. One way to accomplish this is for the attacker to simply modify an existing account. Auditing of account modification is one method and best practice for mitigating this risk. A comprehensive application account management process ensures an audit trail automatically documents the modification of application user accounts and, as required, notifies administrators, application owners, and/or appropriate individuals. Applications must provide this capability directly, leverage complimentary technology providing this capability, or a combination thereof. -Automated account-auditing processes greatly reduce the risk that accounts will be surreptitiously modified, and provides logging that can be used for forensic purposes. +Automated account-auditing processes greatly reduce the risk that accounts will be surreptitiously modified, and provides logging that can be used for forensic purposes. To address the multitude of policy based access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access mechanisms meeting or exceeding access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> V-41021 @@ -8192,17 +8152,17 @@ From the query prompt: SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. -Determine the trace(s) being used for the auditing requirement. +Determine the trace(s) being used for the auditing requirement. In the following, replace # with a trace ID being used for the auditing requirements. From the query prompt: SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, + 14, 15, 18, 20, + 102, 103, 104, 105, 106, 107, 108, 109, 110, + 111, 112, 113, 115, 116, 117, 118, + 128, 129, 130, + 131, 132, 133, 134, 135, + 152, 153, 170, 171, 172, 173, 175, 176, 177, 178. If any of the audit event IDs required above is not listed, this is a finding. @@ -8210,9 +8170,9 @@ Notes: 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. 3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) +4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; + SELECT * FROM sys.trace_events; 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding. BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount > 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END @@ -8237,17 +8197,17 @@ From the query prompt: SELECT DISTINCT traceid FROM sys.fn_trace_getinfo(0); All currently defined traces for the SQL server instance will be listed. If no traces are returned, this is a finding. -Determine the trace(s) being used for the auditing requirement. +Determine the trace(s) being used for the auditing requirement. In the following, replace # with a trace ID being used for the auditing requirements. From the query prompt: SELECT DISTINCT(eventid) FROM sys.fn_trace_geteventinfo(#); The following required event IDs should be listed: - 14, 15, 18, 20, - 102, 103, 104, 105, 106, 107, 108, 109, 110, - 111, 112, 113, 115, 116, 117, 118, - 128, 129, 130, - 131, 132, 133, 134, 135, - 152, 153, + 14, 15, 18, 20, + 102, 103, 104, 105, 106, 107, 108, 109, 110, + 111, 112, 113, 115, 116, 117, 118, + 128, 129, 130, + 131, 132, 133, 134, 135, + 152, 153, 170, 171, 172, 173, 175, 176, 177, 178. If any of the audit event IDs required above is not listed, this is a finding. @@ -8255,9 +8215,9 @@ Notes: 1. It is acceptable to have the required event IDs spread across multiple traces, provided all of the traces are always active, and the event IDs are grouped in a logical manner. 2. It is acceptable, from an auditing point of view, to include the same event IDs in multiple traces. However, the effect of this redundancy on performance, storage, and the consolidation of audit logs into a central repository, should be taken into account. 3. It is acceptable to trace additional event IDs. This is the minimum list. -4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) +4. Once this check is satisfied, the DBA may find it useful to disable or modify the default trace that is set up by the SQL Server installation process. (Note that the Fix does NOT include code to do this.) Use the following query to obtain a list of all event IDs, and their meaning: - SELECT * FROM sys.trace_events; + SELECT * FROM sys.trace_events; 5. Because this check procedure is designed to address multiple requirements/vulnerabilities, it may appear to exceed the needs of some individual requirements. However, it does represent the aggregate of all such requirements. 6. Microsoft has flagged the trace techniques and tools used in this Check and Fix as deprecated. They will be removed at some point after SQL Server 2014. The replacement feature is Extended Events. If Extended Events are in use, and cover all the required audit events listed above, this is not a finding. BEGIN IF OBJECT_ID('TempDB.dbo.#StigEvent') IS NOT NULL BEGIN DROP TABLE #StigEvent END IF OBJECT_ID('TempDB.dbo.#Trace') IS NOT NULL BEGIN DROP TABLE #Trace END IF OBJECT_ID('TempDB.dbo.#TraceEvent') IS NOT NULL BEGIN DROP TABLE #TraceEvent END CREATE TABLE #StigEvent (EventId INT) INSERT INTO #StigEvent (EventId) VALUES (14),(15),(18),(20),(102),(103),(104),(105),(106),(107),(108),(109),(110),(111),(112),(113),(115),(116),(117),(118),(128),(129),(130),(131),(132),(133),(134),(135),(152),(153),(170),(171),(172),(173),(175),(176),(177),(178) CREATE TABLE #Trace (TraceId INT) INSERT INTO #Trace (TraceId) SELECT DISTINCT TraceId FROM sys.fn_trace_getinfo(0)ORDER BY TraceId DESC CREATE TABLE #TraceEvent (TraceId INT, EventId INT) DECLARE cursorTrace CURSOR FOR SELECT TraceId FROM #Trace OPEN cursorTrace DECLARE @currentTraceId INT FETCH NEXT FROM cursorTrace INTO @currentTraceId WHILE @@FETCH_STATUS = 0 BEGIN INSERT INTO #TraceEvent (TraceId, EventId) SELECT DISTINCT @currentTraceId, EventId FROM sys.fn_trace_geteventinfo(@currentTraceId) FETCH NEXT FROM cursorTrace INTO @currentTraceId END CLOSE cursorTrace DEALLOCATE cursorTrace DECLARE @missingStigEventCount INT SET @missingStigEventCount = (SELECT COUNT(*) FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL) IF @missingStigEventCount > 0 BEGIN DECLARE @dir nvarchar(4000) DECLARE @tracefile nvarchar(4000) DECLARE @returnCode INT DECLARE @newTraceId INT DECLARE @maxFileSize BIGINT = 5 EXEC master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\Setup', N'SQLPath', @dir OUTPUT, 'no_output' SET @tracefile = @dir + N'\Log\PowerStig' EXEC @returnCode = sp_trace_create @traceid = @newTraceId OUTPUT, @options = 2, @tracefile = @tracefile, @maxfilesize = @maxFileSize, @stoptime = NULL, @filecount = 2; IF @returnCode = 0 BEGIN EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 0 DECLARE cursorMissingStigEvent CURSOR FOR SELECT DISTINCT SE.EventId FROM #StigEvent SE LEFT JOIN #TraceEvent TE ON SE.EventId = TE.EventId WHERE TE.EventId IS NULL OPEN cursorMissingStigEvent DECLARE @currentStigEventId INT FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId WHILE @@FETCH_STATUS = 0 BEGIN EXEC sp_trace_setevent @traceid = @newTraceId, @eventid = @currentStigEventId, @columnid = NULL, @on = 1 FETCH NEXT FROM cursorMissingStigEvent INTO @currentStigEventId END CLOSE cursorMissingStigEvent DEALLOCATE cursorMissingStigEvent EXEC sp_trace_setstatus @traceid = @newTraceId, @status = 1 END END END @@ -8293,7 +8253,7 @@ sys.server_permissions what INNER JOIN sys.server_principals who ON who.principal_id = what.grantee_principal_id WHERE -what.permission_name = 'View Any Database' +what.permission_name = 'View Any Database' AND who.name NOT LIKE '##MS%##' AND who.type_desc <> 'SERVER_ROLE' ORDER BY diff --git a/StigData/Processed/SqlServer-2016-Instance-1.3.xml b/StigData/Processed/SqlServer-2016-Instance-1.3.xml index bd6d280e5..6c7300b71 100644 --- a/StigData/Processed/SqlServer-2016-Instance-1.3.xml +++ b/StigData/Processed/SqlServer-2016-Instance-1.3.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>Database management includes the ability to control the number of users and user sessions utilizing SQL Server. Unlimited concurrent connections to SQL Server could allow a successful Denial of Service (DoS) attack by exhausting connection resources; and a system can also fail or be degraded by an overload of legitimate users. Limiting the number of concurrent sessions per user is helpful in reducing these risks. @@ -2759,6 +2759,8 @@ WHERE status_desc = 'STARTED' All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding. /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>Without auditing the enforcement of access restrictions against changes to configuration, it would be difficult to identify attempted attacks and an audit trail would not be available for forensic investigation for after-the-fact actions. @@ -2852,6 +2854,8 @@ AND d.audit_action_name IN ( If the identified groups are not returned, this is a finding. /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_ACCESS_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. @@ -2882,6 +2886,8 @@ Reference: https://msdn.microsoft.com/en-us/library/cc280663.aspx /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. @@ -2914,6 +2920,8 @@ Reference: https://msdn.microsoft.com/en-us/library/cc280663.aspx /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. @@ -2944,6 +2952,8 @@ Reference: https://msdn.microsoft.com/en-us/library/cc280663.aspx /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. @@ -2976,6 +2986,8 @@ Reference: https://msdn.microsoft.com/en-us/library/cc280663.aspx /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -3007,6 +3019,8 @@ WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GRO If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding. /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative. @@ -3040,6 +3054,8 @@ WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GRO If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding. /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. @@ -3070,6 +3086,8 @@ Reference: https://msdn.microsoft.com/en-us/library/cc280663.aspx /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. @@ -3102,6 +3120,8 @@ Reference: https://msdn.microsoft.com/en-us/library/cc280663.aspx /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an event occurs, it must be logged.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -3133,6 +3153,8 @@ WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GRO If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding. /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an action is attempted, it must be logged. @@ -3166,6 +3188,8 @@ WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GRO If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding. /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>For completeness of forensic analysis, it is necessary to track who/what (a user or other principal) logs on to SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -3205,6 +3229,8 @@ Right-click on the instance If "Both failed and successful logins" is not selected, this is a finding. /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (SUCCESSFUL_LOGIN_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>For completeness of forensic analysis, it is necessary to track failed attempts to log on to SQL Server. While positive identification may not be possible in a case of failed authentication, as much information as possible about the incident must be captured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -3236,6 +3262,8 @@ WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'FAILED_LOGIN_GROUP' If the "FAILED_LOGIN_GROUP" is not returned in an active audit, this is a finding. /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. @@ -3325,6 +3353,8 @@ AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHAN If the identified groups are not returned, this is a finding. /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. @@ -3401,6 +3431,8 @@ AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHAN If the identified groups are not returned, this is a finding. /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>For completeness of forensic analysis, it is necessary to know how long a user's (or other principal's) connection to SQL Server lasts. This can be achieved by recording disconnections, in addition to logons/connections, in the audit logs. @@ -3465,6 +3497,8 @@ AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHAN If the identified groups are not returned, this is a finding. /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>For completeness of forensic analysis, it is necessary to track who logs on to SQL Server. @@ -3507,6 +3541,8 @@ Right-click on the instance >> Select "Properties" >> Select "Securi If "Both failed and successful logins" is not selected, this is a finding. /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + <VulnDiscussion>SQL Server's [sa] account has special privileges required to administer the database. The [sa] account is a well-known SQL Server account and is likely to be targeted by attackers and thus more prone to providing unauthorized access to the database. @@ -3531,8 +3567,10 @@ GO Verify that the "name" column contains the current name of the [sa] database server account (see note). If the "is_disabled" column is not set to 1, this is a finding. - USE [master] DECLARE @SysAdminAccountName varchar(50), @cmd NVARCHAR(100), @saDisabled int SET @SysAdminAccountName = (SELECT name FROM sys.sql_logins WHERE principal_id = 1) IF @SysAdminAccountName = 'sa' ALTER LOGIN [sa] WITH NAME = [old_sa] SET @SysAdminAccountName = 'old_sa' SELECT @cmd = N'ALTER LOGIN ['+@SysAdminAccountName+'] DISABLE;' SET @saDisabled = (SELECT is_disabled FROM sys.sql_logins WHERE principal_id = 1) IF @saDisabled <> 1 exec sp_executeSQL @cmd; + USE [master] DECLARE @SysAdminAccountName varchar(50), @cmd NVARCHAR(100), @saDisabled int SET @SysAdminAccountName = (SELECT name FROM sys.sql_logins WHERE principal_id = 1) SELECT @cmd = N'ALTER LOGIN ['+@SysAdminAccountName+'] DISABLE;' SET @saDisabled = (SELECT is_disabled FROM sys.sql_logins WHERE principal_id = 1) IF @saDisabled <> 1 exec sp_executeSQL @cmd; USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled <> 1; + + <VulnDiscussion>SQL Server's [sa] account has special privileges required to administer the database. The [sa] account is a well-known SQL Server account name and is likely to be targeted by attackers, and is thus more prone to providing unauthorized access to the database. @@ -3553,8 +3591,10 @@ WHERE [name] = 'sa' OR [principal_id] = 1; GO If the login account name "SA" or "sa" appears in the query output, this is a finding. - USE [master] DECLARE @SysAdminAccountName varchar(50), @cmd NVARCHAR(100), @saDisabled int SET @SysAdminAccountName = (SELECT name FROM sys.sql_logins WHERE principal_id = 1) IF @SysAdminAccountName = 'sa' ALTER LOGIN [sa] WITH NAME = [old_sa] SET @SysAdminAccountName = 'old_sa' SELECT @cmd = N'ALTER LOGIN ['+@SysAdminAccountName+'] DISABLE;' SET @saDisabled = (SELECT is_disabled FROM sys.sql_logins WHERE principal_id = 1) IF @saDisabled <> 1 exec sp_executeSQL @cmd; + USE [master] DECLARE @SysAdminAccountName varchar(50), @cmd NVARCHAR(100), @saDisabled int SET @SysAdminAccountName = (SELECT name FROM sys.sql_logins WHERE principal_id = 1) SELECT @cmd = N'ALTER LOGIN ['+@SysAdminAccountName+'] DISABLE;' SET @saDisabled = (SELECT is_disabled FROM sys.sql_logins WHERE principal_id = 1) IF @saDisabled <> 1 exec sp_executeSQL @cmd; USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled <> 1; + + diff --git a/StigData/Processed/SqlServer-2016-Instance-1.7.org.default.xml b/StigData/Processed/SqlServer-2016-Instance-1.7.org.default.xml new file mode 100644 index 000000000..b0666d92f --- /dev/null +++ b/StigData/Processed/SqlServer-2016-Instance-1.7.org.default.xml @@ -0,0 +1,8 @@ + + diff --git a/StigData/Processed/SqlServer-2016-Instance-1.7.xml b/StigData/Processed/SqlServer-2016-Instance-1.7.xml new file mode 100644 index 000000000..f66974c6d --- /dev/null +++ b/StigData/Processed/SqlServer-2016-Instance-1.7.xml @@ -0,0 +1,4329 @@ + + + + <VulnDiscussion>Database management includes the ability to control the number of users and user sessions utilizing SQL Server. Unlimited concurrent connections to SQL Server could allow a successful Denial of Service (DoS) attack by exhausting connection resources; and a system can also fail or be degraded by an overload of legitimate users. Limiting the number of concurrent sessions per user is helpful in reducing these risks. + +This requirement addresses concurrent session control for a single account. It does not address concurrent sessions by a single user via multiple system accounts; and it does not deal with the total number of sessions across all accounts. + +The capability to limit the number of concurrent sessions per user must be configured in or added to SQL Server (for example, by use of a logon trigger), when this is technically feasible. Note that it is not sufficient to limit sessions via a web server or application server alone, because legitimate users and adversaries can potentially connect to SQL Server by other means. + +The organization will need to define the maximum number of concurrent sessions by account type, by account, or a combination thereof. In deciding on the appropriate number, it is important to consider the work requirements of the various types of users. For example, 2 might be an acceptable limit for general users accessing the database via an application; but 10 might be too few for a database administrator using a database management GUI tool, where each query tab and navigation pane may count as a separate session. + +(Sessions may also be referred to as connections or logons, which for the purposes of this requirement are synonyms.)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation to determine whether any limits have been defined. If it does not, assume a limit of 10 for database administrators and 2 for all other users. + +If a mechanism other than a logon trigger is used, verify its correct operation by the appropriate means. If it does not work correctly, this is a finding. + +Otherwise, determine if a logon trigger exists: + +In SQL Server Management Studio's Object Explorer tree: +Expand [SQL Server Instance] >> Security >> Server Objects >> Triggers + +OR + +Run the query: +SELECT name FROM master.sys.server_triggers; + +If no triggers are listed, this is a finding. + +If triggers are listed, identify the one(s) limiting the number of concurrent sessions per user. If none are found, this is a finding. If they are present but disabled, this is a finding. + +Examine the trigger source code for logical correctness and for compliance with the documented limit(s). If errors or variances exist, this is a finding. + +Verify that the system does execute the trigger(s) each time a user session is established. If it does not operate correctly for all types of user, this is a finding. + + + <VulnDiscussion>Enterprise environments make account management for applications and databases challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. Managing accounts for the same person in multiple places is inefficient and prone to problems with consistency and synchronization. + +A comprehensive application account management process that includes automation helps to ensure that accounts designated as requiring attention are consistently and promptly addressed. + +Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated, or by disabling accounts located in non-centralized account stores, such as multiple servers. Account management functions can also include: assignment of group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example: using email or text messaging to notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephone notification to report atypical system account usage. + +SQL Server must be configured to automatically utilize organization-level account management functions, and these functions must immediately enforce the organization's current account policy. + +Automation may be comprised of differing technologies that when placed together contain an overall mechanism supporting an organization's automated account management requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine whether SQL Server is configured to use only Windows authentication. + +In the Object Explorer in SQL Server Management Studio (SSMS), right-click on the server instance. +Select "Properties". +Select the Security page. + +If Windows Authentication Mode is selected, this is not a finding. + +OR + +In a query interface such as the SSMS Transact-SQL editor, run the statement: +SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly') +WHEN 1 THEN 'Windows Authentication' +WHEN 0 THEN 'Windows and SQL Server Authentication' +END as [Authentication Mode] + +If the returned value in the "Authentication Mode" column is "Windows Authentication", this is not a finding. + +Mixed mode (both SQL Server authentication and Windows authentication) is in use. If the need for mixed mode has not been documented and approved, this is a finding. + +From the documentation, obtain the list of accounts authorized to be managed by SQL Server. + +Determine the accounts (SQL Logins) actually managed by SQL Server. Run the statement: + +SELECT name +FROM sys.sql_logins +WHERE type_desc = 'SQL_LOGIN' AND is_disabled = 0; + +If any accounts listed by the query are not listed in the documentation, this is a finding. + + + <VulnDiscussion>Enterprise environments make account management for applications and databases challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. Managing accounts for the same person in multiple places is inefficient and prone to problems with consistency and synchronization. + +A comprehensive application account management process that includes automation helps to ensure that accounts designated as requiring attention are consistently and promptly addressed. + +Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated, or by disabling accounts located in non-centralized account stores, such as multiple servers. Account management functions can also include: assignment of group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts. The use of automated mechanisms can include, for example: using email or text messaging to notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using automated telephone notification to report atypical system account usage. + +SQL Server must be configured to automatically utilize organization-level account management functions, and these functions must immediately enforce the organization's current account policy. + +Automation may be comprised of differing technologies that when placed together contain an overall mechanism supporting an organization's automated account management requirements. + +SQL Server supports several authentication methods to allow operation in various environments, Kerberos, NTLM, and SQL Server. An instance of SQL Server must be configured to utilize the most-secure method available. Service accounts utilized by SQL Server should be unique to a given instance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If the SQL Server is not part of an Active Directory domain, this finding is Not Applicable. + +Obtain the fully qualified domain name of the SQL Server instance: + +Launch Windows Explorer. + +Right-click on "Computer" or "This PC" (Varies by OS level), click "Properties". + +Note the value shown for "Full computer name". + +*** Note: For a cluster, this value must be obtained from the Failover Cluster Manager. *** + +Obtain the TCP port that is supporting the SQL Server instance: + +Click Start >> Type "SQL Server 2016 Configuration Manager" >> From the search results, click "SQL Server 2016 Configuration Manager". + +From the tree on the left, expand "SQL Server Network Configuration". + +Click "Protocols for <Instance Name>" where <Instance Name> is the name of the instance (MSSQLSERVER is the default name). + +In the right pane, right-click on "TCP/IP" and choose "Properties". + +In the window that opens, click the "IP Addresses" tab. + +Note the TCP port configured for the instance. + +Obtain the service account that is running the SQL Server service: + +Click "Start". +Type "SQL Server 2016 Configuration Manager". +From the search results, click "SQL Server 2016 Configuration Manager". + +From the tree on the left, select "SQL Server Services". + +Note the account listed in the "Log On As" column for the SQL Server instance being reviewed. + +Launch a command-line or PowerShell window. + +Enter the following command where <Service Account> is the identity of the service account. + +setspn -L <Service Account> + +Example: setspn -L CONTOSO\sql2016svc + +Review the Registered Service Principal Names returned. + +If the listing does not contain the following two service principal names, this is a finding. + +MSSQLSvc/<Fully Qualified Domain Name> +MSSQLSvc/<Fully Qualified Domain Name>:<TCP Port> + +If the MSSQLSvc service is registered for any fully qualified domain names that do not match the current server, this may indicate the service account is shared across SQL Server instances. Review server documentation, if the sharing of service accounts across instances is not documented and authorized, this is a finding. + + + <VulnDiscussion>Authentication with a DoD-approved PKI certificate does not necessarily imply authorization to access SQL Server. To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems, including databases, must be properly configured to implement access control policies. + +Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. + +Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. + +This requirement is applicable to access control enforcement applications, a category that includes database management systems. If SQL Server does not follow applicable policy when approving access, it may be in conflict with networks or other applications in the information system. This may result in users either gaining or being denied access inappropriately and in conflict with applicable policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation to determine the required levels of protection for DBMS server securables, by type of login. + +Review the permissions actually in place on the server. + +If the actual permissions do not match the documented requirements, this is a finding. + +Use the supplemental file "Instance permissions assignments to logins and roles.sql." + + + <VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. + +Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. + +In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring SQL Server's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to SQL Server, even where the application connects to SQL Server with a standard, shared account.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain the list of authorized SQL Server accounts in the system documentation. + +Determine if any accounts are shared. A shared account is defined as a username and password that are used by multiple individuals to log into SQL Server. An example of a shared account is the SQL Server installation account. Windows Groups are not shared accounts as the group itself does not have a password. + +If accounts are determined to be shared, determine if individuals are first individually authenticated. + +If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. + +The key is individual accountability. If this can be traced, this is not a finding. + +If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding. + +Review contents of audit logs, traces and data tables to confirm that the identity of the individual user performing the action is captured. + +If shared identifiers are found, and not accompanied by individual identifiers, this is a finding. + +Note: Privileged installation accounts may be required to be accessed by the DBA or other administrators for system maintenance. In these cases, each use of the account must be logged in some manner to assign accountability for any actions taken during the use of the account. + + + <VulnDiscussion>Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. + +Audit records can be generated from various components within SQL Server (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records. + +DoD has defined the list of events for which SQL Server will provide an audit record generation capability as the following: + +(i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); + +(ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities, or other system-level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and + +(iii) All account creation, modification, disabling, and termination actions. + +Organizations may define additional events requiring continuous or ad hoc auditing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the server documentation to determine if any additional events are required to be audited. If no additional events are required, this is not a finding. + +Execute the following query to get all of the installed audits: + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding. + +To view the actions being audited by the audits, execute the following query: + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 + +Compare the documentation to the list of generated audit events. If there are any missing events, this is a finding. + + + <VulnDiscussion>Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent or interfere with the auditing of critical events. + +Suppression of auditing could permit an adversary to evade detection. + +Misconfigured audits can degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain the list of approved audit maintainers from the system documentation. + +Review the server roles and individual logins that have the following role memberships, all of which enable the ability to create and maintain audit definitions. + +sysadmin +dbcreator + +Review the server roles and individual logins that have the following permissions, all of which enable the ability to create and maintain audit definitions. + +ALTER ANY SERVER AUDIT +CONTROL SERVER +ALTER ANY DATABASE +CREATE ANY DATABASE + +Use the following query to determine the roles and logins that have the listed permissions: + +SELECT-- DISTINCT + CASE + WHEN SP.class_desc IS NOT NULL THEN + CASE + WHEN SP.class_desc = 'SERVER' AND S.is_linked = 0 THEN 'SERVER' + WHEN SP.class_desc = 'SERVER' AND S.is_linked = 1 THEN 'SERVER (linked)' + ELSE SP.class_desc + END + WHEN E.name IS NOT NULL THEN 'ENDPOINT' + WHEN S.name IS NOT NULL AND S.is_linked = 0 THEN 'SERVER' + WHEN S.name IS NOT NULL AND S.is_linked = 1 THEN 'SERVER (linked)' + WHEN P.name IS NOT NULL THEN 'SERVER_PRINCIPAL' + ELSE '???' + END AS [Securable Class], + CASE + WHEN E.name IS NOT NULL THEN E.name + WHEN S.name IS NOT NULL THEN S.name + WHEN P.name IS NOT NULL THEN P.name + ELSE '???' + END AS [Securable], + P1.name AS [Grantee], + P1.type_desc AS [Grantee Type], + sp.permission_name AS [Permission], + sp.state_desc AS [State], + P2.name AS [Grantor], + P2.type_desc AS [Grantor Type], +R.name AS [Role Name] +FROM + sys.server_permissions SP + INNER JOIN sys.server_principals P1 + ON P1.principal_id = SP.grantee_principal_id + INNER JOIN sys.server_principals P2 + ON P2.principal_id = SP.grantor_principal_id + + FULL OUTER JOIN sys.servers S + ON SP.class_desc = 'SERVER' + AND S.server_id = SP.major_id + + FULL OUTER JOIN sys.endpoints E + ON SP.class_desc = 'ENDPOINT' + AND E.endpoint_id = SP.major_id + + FULL OUTER JOIN sys.server_principals P + ON SP.class_desc = 'SERVER_PRINCIPAL' + AND P.principal_id = SP.major_id + +FULL OUTER JOIN sys.server_role_members SRM +ON P.principal_id = SRM.member_principal_id + +LEFT OUTER JOIN sys.server_principals R +ON SRM.role_principal_id = R.principal_id +WHERE sp.permission_name IN ('ALTER ANY SERVER AUDIT','CONTROL SERVER','ALTER ANY DATABASE','CREATE ANY DATABASE') +OR R.name IN ('sysadmin','dbcreator') + +If any of the logins, roles, or role memberships returned have permissions that are not documented, or the documented audit maintainers do not have permissions, this is a finding. + + + <VulnDiscussion>Under some circumstances, it may be useful to monitor who/what is reading privilege/permission/role information. Therefore, it must be possible to configure auditing to do this. DBMSs typically make such information available through views or functions. + +This requirement addresses explicit requests for privilege/permission/role membership information. It does not refer to the implicit retrieval of privileges/permissions/role memberships that SQL Server continually performs to determine if any and every action on the database is permitted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. + +If SQL Server is not required to audit the retrieval of privilege/permission/role membership information, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification: + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding. + + + <VulnDiscussion>Under some circumstances, it may be useful to monitor who/what is reading privilege/permission/role information. Therefore, it must be possible to configure auditing to do this. DBMSs typically make such information available through views or functions. + +This requirement addresses explicit requests for privilege/permission/role membership information. It does not refer to the implicit retrieval of privileges/permissions/role memberships that SQL Server continually performs to determine if any and every action on the database is permitted. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. + +If SQL Server is not required to audit the retrieval of privilege/permission/role membership information, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification. + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding. + + + <VulnDiscussion>Information system auditing capability is critical for accurate forensic analysis. Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. To support analysis, some types of events will need information to be logged that exceeds the basic requirements of event type, time stamps, location, source, outcome, and user identity. If additional information is not available, it could negatively impact forensic investigations into user actions or other malicious events. + +The organization must determine what additional information is required for complete analysis of the audited events. The additional information required is dependent on the type of information (e.g., sensitivity of the data and the environment within which it resides). At a minimum, the organization must employ either full-text recording of privileged commands or the individual identities of users of shared accounts, or both. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. + +Examples of detailed information the organization may require in audit records are full-text recording of privileged commands or the individual identities of shared account users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If a SQL Server Audit is not in use for audit purposes, this is a finding unless a third-party product is being used that can perform detailed auditing for SQL Server. + +Review system documentation to determine whether SQL Server is required to audit any events, and any fields, in addition to those in the standard audit. + +If there are none specified, this is not a finding. + +If SQL Server Audit is in use, compare the audit specification(s) with the documented requirements. + +If any such requirement is not satisfied by the audit specification(s) (or by supplemental, locally-deployed mechanisms), this is a finding. + + + <VulnDiscussion>It is critical that when SQL Server is at risk of failing to process audit logs as required, it takes action to mitigate the failure. Audit processing failures include: software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode. + +When the need for system availability does not outweigh the need for a complete audit trail, SQL Server should shut down immediately, rolling back all in-flight transactions. + +Systems where audit trail completeness is paramount will most likely be at a lower MAC level than MAC I; the final determination is the prerogative of the application owner, subject to Authorizing Official concurrence. In any case, sufficient auditing resources must be allocated to avoid a shutdown in all but the most extreme situations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If the system documentation indicates that availability takes precedence over audit trail completeness, this is not applicable (NA). + +If SQL Server Audit is in use, review the defined server audits by running the statement: + +SELECT * FROM sys.server_audits; + +By observing the [name] and [is_state_enabled] columns, identify the row or rows in use. + +If the [on_failure_desc] is "SHUTDOWN SERVER INSTANCE" on this/these row(s), this is not a finding. Otherwise, this is a finding. + + + <VulnDiscussion>It is critical that when SQL Server is at risk of failing to process audit logs as required, it take action to mitigate the failure. Audit processing failures include; software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode. + +When availability is an overriding concern, approved actions in response to an audit failure are as follows: + +(i) If the failure was caused by the lack of audit record storage capacity, SQL Server must continue generating audit records, if possible (automatically restarting the audit service if necessary), overwriting the oldest audit records in a first-in-first-out manner. + +(ii) If audit records are sent to a centralized collection server and communication with this server is lost or the server fails, SQL Server must queue audit records locally until communication is restored or until the audit records are retrieved manually. Upon restoration of the connection to the centralized collection server, action should be taken to synchronize the local audit data with the collection server. + +Systems where availability is paramount will most likely be MAC I; the final determination is the prerogative of the application owner, subject to Authorizing Official concurrence. In any case, sufficient auditing resources must be allocated to avoid audit data loss in all but the most extreme situations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If the system documentation indicates that availability does not take precedence over audit trail completeness, this is not applicable (NA). + +Execute the following query: + +SELECT a.name 'audit_name', + a.type_desc 'storage_type', + f.max_rollover_files +FROM sys.server_audits a +LEFT JOIN sys.server_file_audits f ON a.audit_id = f.audit_id +WHERE a.is_state_enabled = 1 + +If no records are returned, this is a finding. + +If the "storage_type" is "APPLICATION LOG" or "SECURITY LOG,” this is not a finding. + +If the "storage_type" is "FILE" and "max_rollover_files" is greater than zero, this is not a finding. Otherwise, this is a finding. + + + + <VulnDiscussion>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. + +Depending upon the log format and application, system and application log tools may provide the only means to manipulate and manage application and system log data. It is, therefore, imperative that access to audit tools be controlled and protected from unauthorized access. + +Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the access to audit tools. SQL Server is an application that does provide access to audit data. + +Audit tools include, but are not limited to, OS-provided audit tools, vendor-provided audit tools, and open source audit tools needed to successfully view and manipulate audit information system activity and records. + +If an attacker were to gain access to audit tools, he could analyze audit logs for system weaknesses or weaknesses in the auditing itself. An attacker could also manipulate logs to hide evidence of malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Check the server documentation for a list of approved users with access to SQL Server Audits. + +To create, alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission. To view an Audit log requires the CONTROL SERVER permission. To use Profiler, ALTER TRACE is required. + +Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT, CONTROL SERVER, ALTER TRACE: + +SELECT login.name, perm.permission_name, perm.state_desc +FROM sys.server_permissions perm +JOIN sys.server_principals login +ON perm.grantee_principal_id = login.principal_id +WHERE permission_name in ('CONTROL SERVER', 'ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT','ALTER TRACE') +and login.name not like '##MS_%'; + +If unauthorized accounts have these privileges, this is a finding. + + + <VulnDiscussion>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data. + +Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the modification of audit tools. SQL Server is an application that does provide access to audit data. + +Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Check the server documentation for a list of approved users with access to SQL Server Audits. + +To alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission. + +Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT: + +SELECT login.name, perm.permission_name, perm.state_desc +FROM sys.server_permissions perm +JOIN sys.server_principals login +ON perm.grantee_principal_id = login.principal_id +WHERE permission_name in ('CONTROL SERVER', 'ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT') +and login.name not like '##MS_%'; + +If unauthorized accounts have these privileges, this is a finding. + + + <VulnDiscussion>Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data. + +Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the deletion of audit tools. SQL Server is an application that does provide access to audit data. + +Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Check the server documentation for a list of approved users with access to SQL Server Audits. + +To alter, or drop a server audit, principals require the ALTER ANY SERVER AUDIT or the CONTROL SERVER permission. + +Review the SQL Server permissions granted to principals. Look for permissions ALTER ANY SERVER AUDIT, ALTER ANY DATABASE AUDIT, CONTROL SERVER: + +SELECT login.name, perm.permission_name, perm.state_desc +FROM sys.server_permissions perm +JOIN sys.server_principals login +ON perm.grantee_principal_id = login.principal_id +WHERE permission_name in ('CONTROL SERVER', 'ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT') +and login.name not like '##MS_%'; + +If unauthorized accounts have these privileges, this is a finding. + + + <VulnDiscussion>If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. + +Accordingly, only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. + +Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review Server documentation to determine the authorized owner and users or groups with modify rights for this SQL instance's binary files. Additionally check the owner and users or groups with modify rights for shared software library paths on disk. + +If any unauthorized users are granted modify rights or the owner is incorrect, this is a finding. + +To determine the location for these instance-specific binaries, Launch SQL Server Management Studio (SSMS) >> Connect to the instance to be reviewed >> Right-click server name in Object Explorer >> Click Facets >> Select the Server facet >> Record the value for the "RootDirectory" facet property. + +Navigate to the folder above, and review the "Binn" subdirectory. + + + <VulnDiscussion>If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. + +Accordingly, only qualified and authorized individuals must be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications. + +Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review server documentation to determine the process by which shared software libraries are monitored for change. Ensure the process alerts for changes in a file's ownership, modification dates, and hash value at a minimum. + +If alerts do not at least hash their value, this is a finding. + +To determine the location for these instance-specific binaries: + +Launch SQL Server Management Studio (SSMS) >> Connect to the instance to be reviewed >> Right-click server name in Object Explorer >> Click Facets >> Select the Server facet >> Record the value for the "RootDirectory" facet property + +TIP: Use the Get-FileHash cmdlet shipped with PowerShell 5.0 to get the SHA-2 hash of one or more files. + + + <VulnDiscussion>When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can have significant effects on the overall security of the system. + +If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process. Accordingly, only qualified and authorized individuals must be allowed access to information system components for purposes of initiating changes, including upgrades and modifications. + +DBA and other privileged administrative or application owner accounts are granted privileges that allow actions that can have a great impact on SQL Server security and operation. It is especially important to grant privileged access to only those persons who are qualified and authorized to use them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + From the system documentation, obtain the list of accounts authorized to install/update SQL Server. Run the following PowerShell command to list all users who have installed/modified SQL Server 2016 software and compare the list against those persons who are qualified and authorized to use the software. + +sl "C:\program files\microsoft sql server\130\setup bootstrap\Log" +Get-ChildItem -Recurse | Select-String -Pattern "LogonUser = " + +If any accounts are shown that are not authorized in the system documentation, this is a finding. + + + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. Examples include, but are not limited to, installing advertising software, demonstrations, or browser plugins not related to requirements or providing a wide array of functionality, not required for every mission, that cannot be disabled. + +DBMSs must adhere to the principles of least functionality by providing only essential capabilities. + +Demonstration and sample database objects and applications present publicly known attack points for malicious users. These demonstration and sample objects are meant to provide simple examples of coding specific functions and are not developed to prevent vulnerabilities from being introduced to SQL Server and host system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the server documentation, if this system is identified as a development or test system, this check is Not Applicable. + +If this system is identified as production, gather a listing of databases from the server and look for any matching the following general demonstration database names: + +pubs +Northwind +AdventureWorks +WorldwideImporters + +If any of these databases exist, this is a finding. + + + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. + +DBMSs must adhere to the principles of least functionality by providing only essential capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + From the server documentation, obtain a listing of required components. + +Generate a listing of components installed on the server. + +Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" + +Compare the feature listing against the required components listing. + +If any features are installed, but are not required, this is a finding. + + + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for software products to provide, or install by default, functionality exceeding requirements or mission objectives. + +DBMSs must adhere to the principles of least functionality by providing only essential capabilities. + +Unused, unnecessary DBMS components increase the attack vector for SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. Components of the system that are unused and cannot be uninstalled must be disabled. The techniques available for disabling components will vary by DBMS product, OS, and the nature of the component and may include DBMS configuration settings, OS service settings, OS file access security, and DBMS user/role permissions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + From the server documentation, obtain a listing of required components. + +Generate a listing of components installed on the server. + +Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" + +Compare the feature listing against the required components listing. Note any components that are installed, but not required. + +Launch SQL Server Configuration Manager. + +If any components that are installed but are not required are not disabled, this is a finding. + +If any required components are not installed, this is a finding. + + + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. + +The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity. + +To determine if xp_cmdshell is enabled, execute the following commands: + +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'xp_cmdshell'; + +If the value of "config_value" is "0", this is not a finding. + +Review the system documentation to determine whether the use of "xp_cmdshell" is required and approved. If it is not approved, this is a finding. + + + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. + +The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime. + +To determine if CLR is enabled, execute the following commands: + +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'clr enabled'; + +If the value of "config_value" is "0", this is not a finding. + +Review the system documentation to determine whether the use of CLR code is required and approved. If it is not approved, this is a finding. + +If CLR code is required and approved, check for UNSAFE Assembly permission using the following script in Master. If records are returned and UNSAFE Assembly is not documented and authorized, this is a finding. + +SELECT * +FROM sys.assemblies +WHERE permission_set_desc != 'SAFE' +AND is_user_defined = 1 + + + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. + +Extended stored procedures are DLLs that an instance of SQL Server can dynamically load and run. Extended stored procedures run directly in the address space of an instance of SQL Server and are programmed by using the SQL Server Extended Stored Procedure API. Non-Standard extended stored procedures can compromise the integrity of the SQL Server process. This feature will be removed in a future version of Microsoft SQL Server. Do not use this feature in new development work, and modify applications that currently use this feature as soon as possible.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Extended stored procedures are DLLs that an instance of SQL Server can dynamically load and run. Extended stored procedures run directly in the address space of an instance of SQL Server and are programmed by using the SQL Server Extended Stored Procedure API. + +Non-Standard extended stored procedures can compromise the integrity of the SQL Server process. This feature will be removed in a future version of Microsoft SQL Server. Do not use this feature in new development work, and modify applications that currently use this feature as soon as possible. + +To determine if non-standard extended stored procedures exist, run the following: + +------------------------------------------------------------------------ +USE [master] +GO +DECLARE @xplist AS TABLE +( + xp_name sysname, + source_dll nvarchar(255) +) +INSERT INTO @xplist +EXEC sp_helpextendedproc + +SELECT X.xp_name, X.source_dll, O.is_ms_shipped FROM @xplist X JOIN sys.all_objects O ON X.xp_name = O.name WHERE O.is_ms_shipped = 0 ORDER BY X.xp_name +------------------------------------------------------------------------ + +If any records are returned, review the system documentation to determine whether the use of Non-Standard extended stored procedures are required and approved. + +If it is not approved, this is a finding. + + + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed. This access may be exploited by malicious users who have compromised the integrity of the SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed. + +To obtain a list of linked servers, execute the following command: + +EXEC sp_linkedservers; + +Review the system documentation to determine whether the linked servers listed are required and approved. If it is not approved, this is a finding. + +Run the following to get a linked server login mapping: + +SELECT s.name, p.principal_id, l.remote_name +FROM sys.servers s +JOIN sys.linked_logins l ON s.server_id = l.server_id +LEFT JOIN sys.server_principals p ON l.local_principal_id = p.principal_id +WHERE s.is_linked = 1 + +Review the linked login mapping and check the remote name as it can impersonate sysadmin. If a login in the list is impersonating sysadmin and system documentation does not require this, it is a finding. + + + <VulnDiscussion>In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports on information systems. + +Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. + +To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of ports to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. + +SQL Server using ports deemed unsafe is open to attack through those ports. This can allow unauthorized access to the database and through the database to other components of the information system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review SQL Server Configuration for the ports used by SQL Server. + +To determine whether SQL Server is configured to use a fixed port or dynamic ports, in the right-hand pane double-click on the TCP/IP entry, to open the Properties dialog. (The default fixed port is 1433.) + +If these are in conflict with PPSM guidance, and not explained and approved in the system documentation, this is a finding. + + + <VulnDiscussion>OS/enterprise authentication and identification must be used (SRG-APP-000023-DB-000001). Native DBMS authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved. + +The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. + +In such cases, the DoD standards for password complexity and lifetime must be implemented. DBMS products that can inherit the rules for these from the operating system or access control program (e.g., Microsoft Active Directory) must be configured to do so. For other DBMSs, the rules must be enforced using available configuration parameters or custom code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Execute the following query to determine if Contained Databases are used: + +SELECT * FROM sys.databases WHERE containment = 1 + +If any records are returned. Check the server documentation for a list of authorized contained database users. Ensure contained database users are not using SQL Authentication. + +EXEC sp_MSforeachdb 'USE [?]; SELECT DB_NAME() AS DatabaseName, * FROM sys.database_principals WHERE authentication_type = 2' + +If any records are returned, this is a finding. + + + <VulnDiscussion>Non-organizational users include all information system users other than organizational users, which include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). + +Non-organizational users must be uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization when related to the use of anonymous access, such as accessing a web server. + +Accordingly, a risk assessment is used in determining the authentication needs of the organization. + +Scalability, practicality, and security are simultaneously considered in balancing the need to ensure ease of use for access to federal information and information systems with the need to protect and adequately mitigate risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review documentation, SQL Server settings, and authentication system settings to determine if non-organizational users are individually identified and authenticated when logging onto the system. + +Execute the following query to obtain a list of logins on the SQL Server and ensure all accounts are uniquely identifiable: + +SELECT name, type_desc FROM sys.server_principals WHERE type in ('S','U') + +If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to SQL Server using a standard, shared account, ensure that it also captures the individual user identification and passes it to SQL Server. + +If the documentation indicates that this is a public-facing, read-only (from the point of view of public users) database that does not require individual authentication, this is not a finding. + +If non-organizational users are not uniquely identified and authenticated, this is a finding. + + + <VulnDiscussion>This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information. Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system. Applications and application users generate information throughout the course of their application use. + +User data generated, as well as application-specific configuration data, needs to be protected. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate. + +If the confidentiality and integrity of SQL Server data is not protected, the data will be open to compromise and unauthorized modification.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, the severity of this check should be downgraded to Category II. + +If the application owner and Authorizing Official have determined that encryption of data at rest is required, ensure the data on secondary devices is encrypted. + +If full-disk encryption is being used, this is not a finding. + +If data encryption is required, ensure the data is encrypted before being put on the secondary device by executing: + +SELECT +d.name AS [Database Name], +CASE e.encryption_state +WHEN 0 THEN 'No database encryption key present, no encryption' +WHEN 1 THEN 'Unencrypted' +WHEN 2 THEN 'Encryption in progress' +WHEN 3 THEN 'Encrypted' +WHEN 4 THEN 'Key change in progress' +WHEN 5 THEN 'Decryption in progress' +WHEN 6 THEN 'Protection change in progress' +END AS [Encryption State] +FROM sys.dm_database_encryption_keys e +RIGHT JOIN sys.databases d ON DB_NAME(e.database_id) = d.name +WHERE d.name NOT IN ('master','model','msdb') +ORDER BY [Database Name] ; + +For each user database where encryption is required, verify that encryption is in effect. If not, this is a finding. + +Verify that there are physical security measures, operating system access control lists and organizational controls appropriate to the sensitivity level of the data in the database(s). If not, this is a finding. + + + <VulnDiscussion>The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review system documentation to determine if Common Criteria Compliance is not required due to potential impact on system performance. + +SQL Server Residual Information Protection (RIP) requires a memory allocation to be overwritten with a known pattern of bits before memory is reallocated to a new resource. Meeting the RIP standard can contribute to improved security; however, overwriting the memory allocation can slow performance. After the common criteria compliance enabled option is enabled, the overwriting occurs. + +Review the Instance configuration: + + +SELECT value_in_use +FROM sys.configurations +WHERE name = 'common criteria compliance enabled' + +If the value returned for "value_in_use" is not "1", and an exception is not defined in the system documentation, this is a finding. + + +NOTE: Enabling this feature may impact performance on highly active SQL Server instances. If enabling this feature impacts performance, this setting may be disabled and the category reduced to a CAT III finding. + + + <VulnDiscussion>The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation to determine if Instant File Initialization (IFI) is required. + +If IFI is documented as required, this is not a finding. + +Review system configuration to determine whether IFI support has been enabled (by default in SQL Server 2016). + +Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> User Rights Assignment + +If the SQL Service SID (Default instance: NT SERVICE\MSSQLSERVER. Named instance: NT SERVICE\MSSQL$InstanceName) has been granted "Perform volume maintenance tasks" Local Rights Assignment and if it is not documented in the system documentation, this is a finding. + + + <VulnDiscussion>SQL Server must prevent unauthorized and unintended information transfer via shared system resources. Permitting only SQL Server processes and authorized, administrative users to have access to the files where the database resides helps ensure that those files are not shared inappropriately and are not open to backdoor access and manipulation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the permissions granted to users by the operating system/file system on the database files, database log files, and database backup files. + +To obtain the location of SQL Server data, transaction log, and backup files, open and execute the supplemental file "Get SQL Data and Backup Directories.sql". + +For each of the directories returned by the above script, verify whether the correct permissions have been applied. + +1) Launch Windows Explorer. +2) Navigate to the folder. +3) Right-click the folder and click "Properties". +4) Navigate to the "Security" tab. +5) Review the listing of principals and permissions. + +Account Type Directory Type Permission +----------------------------------------------------------------------------------------------- +Database Administrators ALL Full Control +SQL Server Service SID Data; Log; Backup; Full Control +SQL Server Agent Service SID Backup Full Control +SYSTEM ALL Full Control +CREATOR OWNER ALL Full Control + +For information on how to determine a "Service SID", go to: +https://aka.ms/sql-service-sids + +Additional permission requirements, including full directory permissions and operating system rights for SQL Server, are documented at: +https://aka.ms/sqlservicepermissions + +If any additional permissions are granted but not documented as authorized, this is a finding. + + + <VulnDiscussion>Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. + +System documentation should include a definition of the functionality considered privileged. + +Depending on circumstances, privileged functions can include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users. + +A privileged function in SQL Server/database context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to: +CREATE +ALTER +DROP +GRANT +REVOKE +DENY + +There may also be Data Manipulation Language (DML) statements that, subject to context, should be regarded as privileged. Possible examples include: + +TRUNCATE TABLE; +DELETE, or +DELETE affecting more than n rows, for some n, or +DELETE without a WHERE clause; + +UPDATE or +UPDATE affecting more than n rows, for some n, or +UPDATE without a WHERE clause; + +Any SELECT, INSERT, UPDATE, or DELETE to an application-defined security table executed by other than a security principal. + +Depending on the capabilities of SQL Server and the design of the database and associated applications, the prevention of unauthorized use of privileged functions may be achieved by means of DBMS security features, database triggers, other mechanisms, or a combination of these.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review server-level securables and built-in role membership to ensure only authorized users have privileged access and the ability to create server-level objects and grant permissions to themselves or others. + +Review the system documentation to determine the required levels of protection for DBMS server securables, by type of login. + +Review the permissions in place on the server. If the actual permissions do not match the documented requirements, this is a finding. + +Get all permission assignments to logins and roles: + +SELECT DISTINCT + CASE + WHEN SP.class_desc IS NOT NULL THEN + CASE + WHEN SP.class_desc = 'SERVER' AND S.is_linked = 0 THEN 'SERVER' + WHEN SP.class_desc = 'SERVER' AND S.is_linked = 1 THEN 'SERVER (linked)' + ELSE SP.class_desc + END + WHEN E.name IS NOT NULL THEN 'ENDPOINT' + WHEN S.name IS NOT NULL AND S.is_linked = 0 THEN 'SERVER' + WHEN S.name IS NOT NULL AND S.is_linked = 1 THEN 'SERVER (linked)' + WHEN P.name IS NOT NULL THEN 'SERVER_PRINCIPAL' + ELSE '???' + END AS [Securable Class], + CASE + WHEN E.name IS NOT NULL THEN E.name + WHEN S.name IS NOT NULL THEN S.name + WHEN P.name IS NOT NULL THEN P.name + ELSE '???' + END AS [Securable], + P1.name AS [Grantee], + P1.type_desc AS [Grantee Type], + sp.permission_name AS [Permission], + sp.state_desc AS [State], + P2.name AS [Grantor], + P2.type_desc AS [Grantor Type] +FROM + sys.server_permissions SP + INNER JOIN sys.server_principals P1 + ON P1.principal_id = SP.grantee_principal_id + INNER JOIN sys.server_principals P2 + ON P2.principal_id = SP.grantor_principal_id + + FULL OUTER JOIN sys.servers S + ON SP.class_desc = 'SERVER' + AND S.server_id = SP.major_id + + FULL OUTER JOIN sys.endpoints E + ON SP.class_desc = 'ENDPOINT' + AND E.endpoint_id = SP.major_id + + FULL OUTER JOIN sys.server_principals P + ON SP.class_desc = 'SERVER_PRINCIPAL' + AND P.principal_id = SP.major_id + +Get all server role memberships: + +SELECT + R.name AS [Role], + M.name AS [Member] +FROM + sys.server_role_members X + INNER JOIN sys.server_principals R ON R.principal_id = X.role_principal_id + INNER JOIN sys.server_principals M ON M.principal_id = X.member_principal_id + +The CONTROL SERVER permission is similar but not identical to the sysadmin fixed server role. Permissions do not imply role memberships and role memberships do not grant permissions. (e.g., CONTROL SERVER does not imply membership in the sysadmin fixed server role.) + +Ensure only the documented and approved logins have privileged functions in SQL Server. + +If the current configuration does not match the documented baseline, this is a finding. + + + <VulnDiscussion>In certain situations, to provide required functionality, a DBMS needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking the functionality applications/programs, those users are indirectly provided with greater privileges than assigned by organizations. + +Privilege elevation must be utilized only where necessary and protected from misuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the server documentation to obtain a listing of accounts used for executing external processes. Execute the following query to obtain a listing of accounts currently configured for use by external processes. + +SELECT C.name AS credential_name, C.credential_identity +FROM sys.credentials C +GO + +SELECT P.name AS proxy_name, C.name AS credential_name, C.credential_identity +FROM sys.credentials C +JOIN msdb.dbo.sysproxies P ON C.credential_id = P.credential_id +WHERE P.enabled = 1 +GO + +If any Credentials or SQL Agent Proxy accounts are returned that are not documented and authorized, this is a finding. + + + <VulnDiscussion>Without the ability to centrally manage the content captured in the audit records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a delayed or incomplete analysis of an ongoing attack. + +The content captured in audit records must be managed from a central location (necessitating automation). Centralized management of audit records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. + +SQL Server may write audit records to database tables, to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation for a description of how audit records are off-loaded and how local audit log space is managed. + +If the SQL Server audit records are not written directly to or systematically transferred to a centralized log management system, this is a finding. + + + <VulnDiscussion>If the configuration of SQL Server's auditing is spread across multiple locations in the database management software, or across multiple commands, only loosely related, it is harder to use and takes longer to reconfigure in response to events. + +SQL Server must provide a unified tool for audit configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation for a description of how audit records are off-loaded and how local audit log space is managed. + +If the SQL Server audit records (to include traces used for audit purposes) are not written directly to or systematically transferred to a centralized log management system, this is a finding. + + + <VulnDiscussion>In order to ensure sufficient storage capacity for the audit logs, SQL Server must be able to allocate audit record storage capacity. Although another requirement (SRG-APP-000515-DB-000318) mandates that audit data be off-loaded to a centralized log management system, it remains necessary to provide space on the database server to serve as a buffer against outages and capacity limits of the off-loading mechanism. + +The task of allocating audit record storage capacity is usually performed during initial installation of SQL Server and is closely associated with the DBA and system administrator roles. The DBA or system administrator will usually coordinate the allocation of physical drive space with the application owner/installer and the application will prompt the installer to provide the capacity information, the physical location of the disk, or both. + +In determining the capacity requirements, consider such factors as: total number of users; expected number of concurrent users during busy periods; number and type of events being monitored; types and amounts of data being captured; the frequency/speed with which audit records are off-loaded to the central log management system; and any limitations that exist on SQL Server's ability to reuse the space formerly occupied by off-loaded records.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Check the server documentation for the SQL Audit file size configurations. Locate the Audit file path and drive. + +SELECT max_file_size, max_rollover_files, log_file_path AS "Audit Path" +FROM sys.server_file_audits + +Calculate the space needed as the maximum file size and number of files from the SQL Audit File properties. + +If the calculated product of the "max_file_size" times the "max_rollover_files" exceeds the size of the storage location or if "max_file_size" or "max_rollover_files" are set to "0" (UNLIMITED), this is a finding. + + + <VulnDiscussion>It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. + +The appropriate support staff include, at a minimum, the ISSO and the DBA/SA. + +Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less). Alerts can be generated using tools like the SQL Server Agent Alerts and Database Mail.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation to determine which audit failure events require real-time alerts. + +Review SQL Server settings and code. If the real-time alerting that is specified in the documentation is not enabled, this is a finding. + + + <VulnDiscussion>If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis. + +Time stamps generated by SQL Server must include date and time. Time is commonly expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + SQL Server audits store the timestamp in UTC time. + +Determine if the computer is joined to a domain. + +SELECT DEFAULT_DOMAIN()[DomainName] + +If this is not NULL, this is not a finding. + +If the computer is not joined to a domain, determine what the time source is. (Run the following command in an elevated PowerShell session.) + + w32tm /query /source + +If the results of the command return "Local CMOS Clock" and is not documented with justification and AO authorization, this is a finding. + +If the OS does not synchronize with a time server, review the procedure for maintaining accurate time on the system. + +If such a procedure does not exist, this is a finding. + +If the procedure exists, review evidence that the correct time is actually maintained. + +If the evidence indicates otherwise, this is a finding. + + + <VulnDiscussion>Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system. + +When dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. + +Accordingly, only qualified and authorized individuals should be allowed to obtain access to system components for the purposes of initiating changes, including upgrades and modifications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain a list of logins who have privileged permissions and role memberships in SQL. + +Execute the following query to obtain a list of logins and roles and their respective permissions assignment: + +SELECT p.name AS Principal, +p.type_desc AS Type, +sp.permission_name AS Permission, +sp.state_desc AS State +FROM sys.server_principals p +INNER JOIN sys.server_permissions sp ON p.principal_id = sp.grantee_principal_id +WHERE sp.permission_name = 'CONTROL SERVER' +OR sp.state = 'W' + +Execute the following query to obtain a list of logins and their role memberships. + +SELECT m.name AS Member, +m.type_desc AS Type, +r.name AS Role +FROM sys.server_principals m +INNER JOIN sys.server_role_members rm ON m.principal_id = rm.member_principal_id +INNER JOIN sys.server_principals r ON rm.role_principal_id = r.principal_id +WHERE r.name IN ('sysadmin','securityadmin','serveradmin') + +Check the server documentation to verify the logins and roles returned are authorized. If the logins and/or roles are not documented and authorized, this is a finding. + + + <VulnDiscussion>Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system. + +When dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the information system can potentially have significant effects on the overall security of the system. + +Accordingly, only qualified and authorized individuals should be allowed to obtain access to system components for the purposes of initiating changes, including upgrades and modifications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain a list of users who have privileged access to the server via the local Administrators group. + +Launch lusrmgr.msc +Select Groups +Double-click Administrators + +Alternatively, execute the following command in PowerShell: + +net localgroup administrators + +Check the server documentation to verify the users returned are authorized. + +If the users are not documented and authorized, this is a finding. + + + <VulnDiscussion>Use of nonsecure network functions, ports, protocols, and services exposes the system to avoidable threats.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + SQL Server must only use approved network communication libraries, ports, and protocols. + +Obtain a list of all approved network libraries, communication ports, and protocols from the server documentation. + +Verify that the protocols are enabled for the instance. + +If any ports or protocols are used that are not specifically approved in the server documentation, this is a finding. + + + <VulnDiscussion>Database management systems can maintain separate execution domains for each executing process by assigning each process a separate address space. + +Each process has a distinct address space so that communication between processes is controlled through the security functions, and one process cannot modify the executing code of another process. + +Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the server documentation to determine whether use of CLR assemblies is required. Run the following query to determine whether CLR is enabled for the instance: + +SELECT name, value, value_in_use +FROM sys.configurations +WHERE name = 'clr enabled' + +If "value_in_use" is a "1" and CLR is not required, this is a finding. + + + <VulnDiscussion>Database management systems can maintain separate execution domains for each executing process by assigning each process a separate address space. Each process has a distinct address space so that communication between processes is controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the server documentation to obtain a listing of required service accounts. Review the accounts configured for all SQL Server services installed on the server. + +Click Start >> Type "SQL Server Configuration Manager" >> Launch the program >> Click SQL Server Services tree node. Review the "Log On As" column for each service. + +If any services are configured with the same service account or are configured with an account that is not documented and authorized, this is a finding. + + + <VulnDiscussion>Previous versions of DBMS components that are not removed from the information system after updates have been installed may be exploited by adversaries. + +Some DBMSs' installation tools may remove older versions of software automatically from the information system. In other cases, manual review and removal will be required. In planning installations and upgrades, organizations must include steps (automated, manual, or both) to identify and remove the outdated modules. + +A transition period may be necessary when both the old and the new software are required. This should be taken into account in the planning.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + From the server documentation, obtain a listing of required components. + +Generate a listing of components installed on the server. + +Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" + +Compare the feature listing against the required components listing. If any features are installed, but are not required, this is a finding. + + + <VulnDiscussion>Changes to the security configuration must be tracked. + +This requirement applies to situations where security data is retrieved or modified via data manipulation operations, as opposed to via specialized security functionality. + +In an SQL environment, types of access include, but are not necessarily limited to: +SELECT +INSERT +UPDATE +DELETE +EXECUTE + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_statu + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a finding. + + + <VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation to determine if SQL Server is required to audit when data classifications are retrieved. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding. + + + <VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully retrieved. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding. + + + <VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation to determine if SQL Server is required to audit when data classifications are modified. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding. + + + <VulnDiscussion>Changes in categories of information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully modified. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding. + + + <VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation to determine if SQL Server is required to audit when data classifications are deleted. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding. + + + <VulnDiscussion>Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones. + +For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully deleted. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding. + + + <VulnDiscussion>Without tracking all or selected types of access to all or selected objects (tables, views, procedures, functions, etc.), it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. + +In an SQL environment, types of access include, but are not necessarily limited to: +SELECT +INSERT +UPDATE +DELETE +EXECUTE</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation to determine if SQL Server is required to audit when successful accesses to objects occur. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding. + + + <VulnDiscussion>Without tracking all or selected types of access to all or selected objects (tables, views, procedures, functions, etc.), it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. + +In an SQL environment, types of access include, but are not necessarily limited to: +SELECT +INSERT +UPDATE +DELETE +EXECUTE + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation to determine if SQL Server is required to audit when unsuccessful accesses to objects occur. + +If this is not required, this is not a finding. + +If the documentation does not exist, this is a finding. + +Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the "SCHEMA_OBJECT_ACCESS_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding. + + + <VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. + +It is the responsibility of the data owner to assess the cryptography requirements in light of applicable federal laws, Executive Orders, directives, policies, regulations, and standards. + +For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the server documentation, if this system does not contain data that must be encrypted, this finding is NA. + +Verify that Windows is configured to require the use of FIPS 140-2 algorithms for the unclassified information that requires it. + +Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." + +If "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding. + + + <VulnDiscussion>Information stored in one location is vulnerable to accidental or incidental deletion or alteration. + +Off-loading is a common process in information systems with limited audit storage capacity. + +The system SQL Server may write audit records to database tables, to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation for a description of how audit records are off-loaded. + +If the system has a continuous network connection to the centralized log management system, but the DBMS audit records are not written directly to the centralized log management system or transferred in near-real-time, this is a finding. + +If the system does not have a continuous network connection to the centralized log management system, and the DBMS audit records are not transferred to the centralized log management system weekly or more often, this is a finding. + + + <VulnDiscussion>By default, Microsoft SQL Server enables participation in the customer experience improvement program (CEIP). This program collects information about how its customers are using the product. Specifically, SQL Server collects information about the installation experience, feature usage, and performance. This information helps Microsoft improve the product to better meet customer needs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Launch "Registry Editor" + +Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\[InstanceId]\CPE +Review the following values: CustomerFeedback, EnableErrorReporting + +Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\130 +Review the following values: CustomerFeedback, EnableErrorReporting + +If this is a classified system, and any of the above values are not zero (0), this is a finding. + +If this is an unclassified system, review the server documentation to determine whether CEIP participation is authorized. + +If CEIP participation is not authorized, and any of the above values are one (1), this is a finding. + + + <VulnDiscussion>By default, Microsoft SQL Server enables participation in the customer experience improvement program (CEIP). This program collects information about how its customers are using the product. Specifically, SQL Server collects information about the installation experience, feature usage, and performance. This information helps Microsoft improve the product to better meet customer needs. The Local Audit component of SQL Server Usage Feedback collection writes data collected by the service to a designated folder, representing the data (logs) that will be sent to Microsoft. The purpose of the Local Audit is to allow customers to see all data Microsoft collects with this feature, for compliance, regulatory or privacy validation reasons.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the server documentation to determine if auditing of the telemetry data is required. If auditing of telemetry data is not required, this is not a finding. + +If auditing of telemetry data is required, determine the telemetry service user name by executing the following query: + +SELECT name +FROM sys.server_principals +WHERE name LIKE '%SQLTELEMETRY%' + +Review the values of the following registry key: +Note: InstanceId refers to the type and instance of the feature. (e.g., MSSQL13.SqlInstance, MSAS13.SSASInstance, MSRS13.SSRSInstance) + +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\[InstanceId]\CPE\UserRequestedLocalAuditDirectory + +If the registry key do not exist or the value is blank, this is a finding. + +Navigate the path defined in the "UserRequestedLocalAuditDirectory" registry key in file explorer. + +Right-click on the folder and choose "Properties". +Open the "Security" tab. + +Verify the SQLTELEMETRY account has the following permissions: + +- List folder contents +- Read +- Write + +If the permissions are not set properly on the folder, this is a finding. + +Open services.msc and find the telemetry service. +- For Database Engine, use SQL Server CEIP service (<INSTANCENAME>). +- For Analysis Services, use SQL Server Analysis Services CEIP (<INSTANCENAME>). + +Right-click on the service and choose "Properties". Verify the "Startup type" is "Automatic." + +If the service is not configured to automatically start, this is a finding. + +Review the processes and procedures for reviewing the telemetry data. If there is evidence that the telemetry data is periodically reviewed in accordance with the processes and procedures, this is not a finding. + +If no processes and procedures exist for reviewing telemetry data, this is a finding. + + + <VulnDiscussion>In certain situations, to provide required functionality, a DBMS needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking the functionality applications/programs, those users are indirectly provided with greater privileges than assigned by organizations. + +When 'Scan for startup procs' is enabled, SQL Server scans for and runs all automatically run stored procedures defined on the server. The execution of start-up stored procedures will be done under a high privileged context, therefore it is a commonly used post-exploitation vector.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation to obtain a listing of documented stored procedures used by SQL Server during start up. Execute the following query: + +Select [name] as StoredProc +From sys.procedures +Where OBJECTPROPERTY(OBJECT_ID, 'ExecIsStartup') = 1 + +If any stored procedures are returned that are not documented, this is a finding. + + + <VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. + +Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. + +SQL Mirroring endpoints support different encryption algorithms, including no-encryption. Using a weak encryption algorithm or plaintext in communication protocols can lead to data loss, data manipulation and/or connection hijacking.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If the data owner does not have a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, and the requirement is documented and authorized, this is not a finding. + +If Database Mirroring is in use, run the following to check for encrypted transmissions:   + +SELECT name, type_desc, encryption_algorithm_desc +FROM sys.database_mirroring_endpoints +WHERE encryption_algorithm != 2 + +If any records are returned, this is a finding. + + + <VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. + +Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. + +SQL Server Service Broker endpoints support different encryption algorithms, including no-encryption. Using a weak encryption algorithm or plaintext in communication protocols can lead to data loss, data manipulation and/or connection hijacking.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If the data owner does not have a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, and the requirement is documented and authorized, this is not a finding. + +If SQL Service Broker is in use, run the following to check for encrypted transmissions:   + +SELECT name, type_desc, encryption_algorithm_desc +FROM sys.service_broker_endpoints +WHERE encryption_algorithm != 2 + +If any records are returned, this is a finding. + + + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. + +The registry contains sensitive information, including password hashes as well as clear text passwords. Registry extended stored procedures allow Microsoft SQL Server to access the machine's registry. The sensitivity of these procedures are exacerbated if Microsoft SQL Server is run under the Windows account LocalSystem. LocalSystem can read and write nearly all values in the registry, even those not accessible by the Administrator. Unlike the xp_cmdshell extended stored procedure, which runs under a separate context if executed by a login not in the sysadmin role, the registry extended stored procedures always execute under the security context of the MSSQLServer service. Because the sensitive information is stored in the registry, it is essential that access to that information be properly guarded.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + To determine if permissions to execute registry extended stored procedures have been revoked from all users (other than dbo), execute the following command: + +SELECT OBJECT_NAME(major_id) AS [Stored Procedure] +,dpr.NAME AS [Principal] +FROM sys.database_permissions AS dp +INNER JOIN sys.database_principals AS dpr ON dp.grantee_principal_id = dpr.principal_id +WHERE major_id IN ( + OBJECT_ID('xp_regaddmultistring') +,OBJECT_ID('xp_regdeletekey') +,OBJECT_ID('xp_regdeletevalue') +,OBJECT_ID('xp_regenumvalues') +,OBJECT_ID('xp_regenumkeys') +,OBJECT_ID('xp_regremovemultistring') +,OBJECT_ID('xp_regwrite') +,OBJECT_ID('xp_instance_regaddmultistring') +,OBJECT_ID('xp_instance_regdeletekey') +,OBJECT_ID('xp_instance_regdeletevalue') +,OBJECT_ID('xp_instance_regenumkeys') +,OBJECT_ID('xp_instance_regenumvalues') +,OBJECT_ID('xp_instance_regremovemultistring') +,OBJECT_ID('xp_instance_regwrite') +) +AND dp.[type] = 'EX' +ORDER BY dpr.NAME; + +If any records are returned, review the system documentation to determine whether the accessing of the registry via extended stored procedures are required and authorized. If it is not authorized, this is a finding. + + + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +The most significant potential for attacking an instance is through the use of features that expose an external interface or ad hoc execution capability. FILESTREAM integrates the SQL Server Database Engine with an NTFS file system by storing varbinary(max) binary large object (BLOB) data as files on the file system. Transact-SQL statements can insert, update, query, search, and back up FILESTREAM data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the system documentation to see if FileStream is in use. If in use authorized, this is not a finding. + +If FileStream is not documented as being authorized, execute the following query. +EXEC sp_configure 'filestream access level' + +If "run_value" is greater than "0", this is a finding. + + + +This rule checks that Filestream SQL specific option is disabled. + +SELECT CASE + WHEN EXISTS (SELECT * + FROM sys.configurations + WHERE Name = 'filestream access level' + AND Cast(value AS INT) = 0) THEN 'No' + ELSE 'Yes' + END AS TSQLFileStreamAccess; + +If the above query returns "Yes" in the "FileStreamEnabled" field, this is a finding. + + + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. + +SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. + +The Ole Automation Procedures option controls whether OLE Automation objects can be instantiated within Transact-SQL batches. These are extended stored procedures that allow SQL Server users to execute functions external to SQL Server in the security context of SQL Server. + +The Ole Automation Procedures extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + To determine if "Ole Automation Procedures" option is enabled, execute the following query: + +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'Ole Automation Procedures'; + +If the value of "config_value" is "0", this is not a finding. + +If the value of "config_value" is "1", review the system documentation to determine whether the use of "Ole Automation Procedures" is required and authorized. If it is not authorized, this is a finding. + + + <VulnDiscussion>SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. + +The user options option specifies global defaults for all users. A list of default query processing options is established for the duration of a user's work session. The user options option allows you to change the default values of the SET options (if the server's default settings are not appropriate).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + To determine if "User Options" option is enabled, execute the following query: + +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'user options'; + +If the value of "config_value" is "0", this is not a finding. + +If the value of "config_value" is "1", review the system documentation to determine whether the use of "user options" is required and authorized. If it is not authorized, this is a finding. + + + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. + +SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. + +The Remote Access option controls the execution of local stored procedures on remote servers or remote stored procedures on local server.  'Remote access' functionality can be abused to launch a Denial-of-Service (DoS) attack on remote servers by off-loading query processing to a target.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + To determine if "Remote Access" option is enabled, execute the following query: + +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'remote access'; + +If the value of "config_value" is "0", this is not a finding. + +If the value of "config_value" is "1", review the system documentation to determine whether the use of "Remote Access" is required (linked servers) and authorized. If it is not authorized, this is a finding. + + + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. + +SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. + +The Hadoop Connectivity feature allows multiple types of external data sources to be created and used across all sessions on the server.  An exploit to the SQL Server instance could result in a compromise of the host system and external SQL Server resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + To determine if "Hadoop Connectivity" option is enabled, execute the following query: + +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'hadoop connectivity'; + +If the value of "config_value" is "0", this is not a finding. + +If the value of "config_value" is "1", review the system documentation to determine whether the use of "Hadoop Connectivity" option is required and authorized. If it is not authorized, this is a finding. + + + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. + +SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. + +The Allow Polybase Export feature allows an export of data to an external data source such as Hadoop File System or Azure Data Lake. An exploit to the SQL Server instance could result in a compromise of the host system and external SQL Server resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + To determine if "Allow Polybase Export" option is enabled, execute the following query: + +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'allow polybase export'; + +If the value of "config_value" is "0", this is not a finding. + +If the value of "config_value" is "1", review the system documentation to determine whether the use of "Allow Polybase Export" is required and authorized. If it is not authorized, this is a finding. + + + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. + +SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. + +The Remote Data Archive feature allows an export of local SQL Server data to an Azure SQL Database. An exploit to the SQL Server instance could result in a compromise of the host system and external SQL Server resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + To determine if "Remote Data Archive" option is enabled, execute the following query: + +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'remote data archive'; + +If the value of "config_value" is "0", this is not a finding. + +If the value of "config_value" is "1", review the system documentation to determine whether the use of "Remote Data Archive" is required and authorized. If it is not authorized, this is a finding. + + + <VulnDiscussion>SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. + +The External Scripts Enabled feature allows scripts external to SQL such as files located in an R library to be executed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + To determine if "External Scripts Enabled" option is enabled, execute the following query: + +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'external scripts enabled'; + +If the value of "config_value" is "0", this is not a finding. + +If the value of "config_value" is "1", review the system documentation to determine whether the use of "External Scripts Enabled" is required and authorized. If it is not authorized, this is a finding. + + + <VulnDiscussion>The SQL Server Browser simplifies the administration of SQL Server, particularly when multiple instances of SQL Server coexist on the same computer. It avoids the need to hard-assign port numbers to the instances and to set and maintain those port numbers in client systems. It enables administrators and authorized users to discover database management system instances, and the databases they support, over the network. SQL Server uses the SQL Server Browser service to enumerate instances of the Database Engine installed on the computer. This enables client applications to browse for a server, and helps clients distinguish between multiple instances of the Database Engine on the same computer. + +This convenience also presents the possibility of unauthorized individuals gaining knowledge of the available SQL Server resources. Therefore, it is necessary to consider whether the SQL Server Browser is needed. Typically, if only a single instance is installed, using the default name (MSSQLSERVER) and port assignment (1433), the Browser is not adding any value. The more complex the installation, the more likely SQL Server Browser is to be helpful. + +This requirement is not intended to prohibit use of the Browser service in any circumstances.  It calls for administrators and management to consider whether the benefits of its use outweigh the potential negative consequences of it being used by an attacker to browse the current infrastructure and retrieve a list of running SQL Server instances.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If the need for the SQL Server Browser service is documented and authorized, this is not a finding. + +Open the Services tool. + +Either navigate, via the Windows Start Menu and/or Control Panel, to "Administrative Tools", and select "Services"; or at a command prompt, type "services.msc" and press the "Enter" key. + +Scroll to "SQL Server Browser". + +If its Startup Type is not shown as "Disabled", this is a finding. + + + <VulnDiscussion>SQL Server is capable of providing a wide range of features and services. Some of the features and services, provided by default, may not be necessary, and enabling them could adversely affect the security of the system. + +Enabling the replication XPs opens a significant attack surface area that can be used by an attacker to gather information about the system and potentially abuse the privileges of SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + To determine if the "Replication Xps" option is enabled, execute the following query: + +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'replication xps'; + +If the value of "config_value" is "0", this is not a finding. + +If the value of "config_value" is "1", review the system documentation to determine whether the use of "Replication Xps" is required and authorized. If it is not authorized, this is a finding. + + + <VulnDiscussion>The SQL Server Browser simplifies the administration of SQL Server, particularly when multiple instances of SQL Server coexist on the same computer. It avoids the need to hard-assign port numbers to the instances and to set and maintain those port numbers in client systems. It enables administrators and authorized users to discover database management system instances, and the databases they support, over the network. SQL Server uses the SQL Server Browser service to enumerate instances of the Database Engine installed on the computer. This enables client applications to browse for a server, and helps clients distinguish between multiple instances of the Database Engine on the same computer. + +This convenience also presents the possibility of unauthorized individuals gaining knowledge of the available SQL Server resources. Therefore, it is necessary to consider whether the SQL Server Browser is needed. Typically, if only a single instance is installed, using the default name (MSSQLSERVER) and port assignment (1433), the Browser is not adding any value. The more complex the installation, the more likely SQL Server Browser is to be helpful. + +This requirement is not intended to prohibit use of the Browser service in any circumstances.  It calls for administrators and management to consider whether the benefits of its use outweigh the potential negative consequences of it being used by an attacker to browse the current infrastructure and retrieve a list of running SQL Server instances. In order to prevent this, the SQL instance(s) can be hidden.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If the need for the SQL Server Browser service is documented and authorized, check to make sure the SQL Instances are hidden with the following query. + +DECLARE @HiddenInstance INT +EXEC master.dbo.Xp_instance_regread +  N'HKEY_LOCAL_MACHINE', +  N'Software\Microsoft\MSSQLServer\MSSQLServer\SuperSocketNetLib', +  N'HideInstance', +  @HiddenInstance output + +SELECT CASE +         WHEN @HiddenInstance = 0 +              AND Serverproperty('IsClustered') = 0 THEN 'No' +         ELSE 'Yes' +       END AS [Hidden] + +If the value of "Hidden" is "Yes", this is not a finding. + +If the value of "Hidden" is "No" and the startup type of the "SQL Server Browser" service is not "Disabled", this is a finding. + + + <VulnDiscussion>To prevent the compromise of authentication information, such as passwords and PINs, during the authentication process, the feedback from the information system must not provide any information that would allow an unauthorized user to compromise the authentication mechanism. + +Obfuscation of user-provided information when typed into the system is a method used in addressing this risk. + +For example, displaying asterisks when a user types in a password or PIN, is an example of obscuring feedback of authentication information. + +This requirement is applicable when mixed-mode authentication is enabled. When this is the case, password-authenticated accounts can be created in and authenticated by SQL Server. Other STIG requirements prohibit the use of mixed-mode authentication except when justified and approved. This deals with the exceptions. + +SQLCMD and other command-line tools are part of any SQL Server installation. These tools can accept a plain-text password, but do offer alternative techniques. Since the typical user of these tools is a database administrator, the consequences of password compromise are particularly serious. Therefore, the use of plain-text passwords must be prohibited, as a matter of practice and procedure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Run this query to determine whether SQL Server authentication is enabled: +EXEC master.sys.xp_loginconfig 'login mode'; + +If the config_value returned is "Windows NT Authentication", this is not a finding. + +For SQLCMD, which cannot be configured not to accept a plain-text password, and any other essential tool with the same limitation, verify that the system documentation explains the need for the tool, who uses it, and any relevant mitigations; and that AO approval has been obtained; if not, this is a finding. + +Request evidence that all users of the tool are trained in the importance of not using the plain-text password option and in how to keep the password hidden; and that they adhere to this practice; if not, this is a finding. + + + + + <VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. + +Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. + +In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring the DBMS's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to the DBMS, even where the application connects to the DBMS with a standard, shared account. + +Any user with enough access to the server can execute a task that will be run as NT AUTHORITY\SYSTEM either using task scheduler or other tools. At this point, NT AUTHORITY\SYSTEM essentially becomes a shared account because the operating system and SQL Server are unable to determine who created the process. + +Prior to SQL Server 2012, NT AUTHORITY\SYSTEM was a member of the sysadmin role by default. This allowed jobs/tasks to be executed in SQL Server without the approval or knowledge of the DBA because it looked like operating system activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Execute the following queries. The first query lists permissions granted to NT AUTHORITY\SYSTEM. The second query checks for Clustering and Availability Groups being provisioned in the Database Engine: + +EXECUTE AS LOGIN = 'NT AUTHORITY\SYSTEM' + +SELECT * FROM fn_my_permissions(NULL,NULL) + +REVERT + +GO + +SELECT SERVERPROPERTY('IsClustered') as IsClustered, SERVERPROPERTY('IsHadrEnabled') as IsHadrEnabled + +If IsHadrEnabled returns 1 and any permissions have been granted to SYSTEM beyond "CONNECT SQL", "ALTER ANY AVAILABILITY GROUP", and "VIEW ANY DATABASE", this is a finding. + +If IsClustered returns 1 and any permissions have been granted to SYSTEM beyond "CONNECT SQL", "VIEW SERVER STATE ", and "VIEW ANY DATABASE", this is a finding. + +If IsHadrEnabled and IsClustered both return 1 and any permissions have been granted to SYSTEM beyond "CONNECT SQL", "ALTER ANY AVAILABILITY GROUP", "VIEW SERVER STATE ", and "VIEW ANY DATABASE", this is a finding. + +If both IsClustered and IsHadrEnabled return 0 and any permissions have been granted to SYSTEM beyond "CONNECT SQL" and "VIEW ANY DATABASE", this is a finding. + + + <VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. + +Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. + +In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring the DBMS's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to the DBMS, even where the application connects to the DBMS with a standard, shared account. + +If the computer account of a remote computer is granted access to SQL Server, any service or scheduled task running as NT AUTHORITY\SYSTEM or NT AUTHORITY\NETWORK SERVICE can log into the instance and perform actions. These actions cannot be traced back to a specific user or process.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Execute the following query: + +SELECT name +FROM sys.server_principals +WHERE type in ('U','G') +AND name LIKE '%$' + +If no logins are returned, this is not a finding. + +If logins are returned, determine whether each login is a computer account. + +Launch PowerShell. + +Execute the following code: + +Note: <name> represents the username portion of the login. For example, if the login is "CONTOSO\user1$", the username is "user1". + +([ADSISearcher]"(&(ObjectCategory=Computer)(Name=<name>))").FindAll() + +If no account information is returned, this is not a finding. + +If account information is returned, this is a finding. + + + <VulnDiscussion>If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage. + +To ensure the veracity of audit data, the information system and/or the application must protect audit information from any and all unauthorized access. This includes read, write, copy, etc. + +This requirement can be achieved through multiple methods which will depend upon system architecture and design. Some commonly employed methods include ensuring log files enjoy the proper file system permissions utilizing file system protections and limiting log data location. + +Additionally, applications with user interfaces to audit records should not allow for the unfettered manipulation of or access to those records via the application. If the application provides access to the audit data, the application becomes accountable for ensuring that audit information is protected from unauthorized access. SQL Server is an application that is able to view and manipulate audit file data. + +Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain the SQL Server audit file location(s) by running the following SQL script: + +SELECT log_file_path AS "Audit Path" +FROM sys.server_file_audits + +For each audit, the path column will give the location of the file. + +Verify that all audit files have the correct permissions by doing the following for each audit file: Navigate to audit folder location(s) using a command prompt or Windows Explorer. + +Right-click the file/folder and click "Properties". On the "Security" tab, verify that at most the following permissions are applied: + +Administrator (read) +Users (none) +Audit Administrator (Full Control) +Auditors group (Read) +SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] +SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) + +If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. + + + <VulnDiscussion>If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve. + +To ensure the veracity of audit data the information system and/or the application must protect audit information from unauthorized modification. + +This requirement can be achieved through multiple methods that will depend upon system architecture and design. Some commonly employed methods include ensuring log files enjoy the proper file system permissions and limiting log data locations. + +Applications providing a user interface to audit data will leverage user permissions and roles identifying the user accessing the data and the corresponding rights that the user enjoys in order to make access decisions regarding the modification of audit data. SQL Server is an application that does provide access to audit file data. + +Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. + +Modification of database audit data could mask the theft of, or the unauthorized modification of, sensitive data stored in the database.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain the SQL Server audit file location(s) by running the following SQL script: + +SELECT log_file_path AS "Audit Path" +FROM sys.server_file_audits + +For each audit, the Audit Path column will give the location of the file. + +Verify that all audit files have the correct permissions by doing the following for each audit file: Navigate to audit folder location(s) using a command prompt or Windows Explorer. The following instructions assume Windows Explorer is used. + +Right-click the file/folder and click "Properties". On the "Security" tab, verify that at most the following permissions are applied: + +Administrator (read) +Users (none) +Audit Administrator (Full Control) +Auditors group (Read) +SQL Server Service SID OR Service Account (Full Control) [Notes 1, 2] +SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) + +If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. + + + <VulnDiscussion>If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve. + +To ensure the veracity of audit data, the information system and/or the application must protect audit information from unauthorized deletion. This requirement can be achieved through multiple methods which will depend upon system architecture and design. + +Some commonly employed methods include; ensuring log files enjoy the proper file system permissions utilizing file system protections; restricting access; and backing up log data to ensure log data is retained. + +Applications providing a user interface to audit data will leverage user permissions and roles identifying the user accessing the data and the corresponding rights the user enjoys in order make access decisions regarding the deletion of audit data. SQL Server is an application that does provide access to audit file data. + +Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity. + +Deletion of database audit data could mask the theft of, or the unauthorized modification of, sensitive data stored in the database.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain the SQL Server audit file location(s) by running the following SQL script: + +SELECT log_file_path AS "Audit Path" +FROM sys.server_file_audits + +For each audit, the path column will give the location of the file. + +Verify that all audit files have the correct permissions by doing the following for each audit file: Navigate to audit folder location(s) using a command prompt or Windows Explorer. + +Right-click the file/folder and click "Properties". On the "Security" tab, verify that at most the following permissions are applied: + +Administrator (read) +Users (none) +Audit Administrator (Full Control) +Auditors group (Read) +SQL Server Service SID OR Service Account (Full Control) +SQL Server SQL Agent Service SID OR Service Account, if SQL Server Agent is in use. (Read, Execute, Write) + +If any less restrictive permissions are present (and not specifically justified and approved), this is a finding. + + + <VulnDiscussion>When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. + +Multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of other applications sharing the same security context. For example, an exploit to a web server process that leads to unauthorized administrative access to host system directories can most likely lead to a compromise of all applications hosted by the same system. Database software not installed using dedicated directories both threatens and is threatened by other hosted applications. Access controls defined for one application may by default provide access to the other application's database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine the directory in which SQL Server has been installed: + +Using SQL Server Management Studio's Object Explorer: +- Right-click [SQL Server Instance] +- Select "Facets" +- Record the value of RootDirectory + +Determine the Operating System directory: +- Click "Start" +- Type "Run" +- Press "Enter" +- Type "%windir%" +- Click "Ok" +- Record the value in the address bar + +Verify the SQL Server RootDirectory is not in the Operating System directory. + +Compare the SQL RootDirectory and the Operating System directory. If the SQL RootDirectory is in the same directory as the Operating System, this is a finding. + +Verify the SQL Server RootDirectory is not in another application's directory. + +Navigate to the SQL RootDirectory using Windows Explorer. + +Examine each directory for evidence another application is stored in it. + +If evidence exists the SQL RootDirectory is in another application's directory, this is a finding. + +If the SQL RootDirectory is not in the Operating System directory or another application's directory. This is not a finding. + +Examples: +1) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is not living in the Operating System directory or the directory of another application. This is not a finding. + +2) The Operating System directory is "C:\Windows". The SQL RootDirectory is "C:\Windows\MSSQLSERVER\MSSQL". This is a finding. + +3) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\Microsoft Office\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is in the Microsoft Office directory, which indicates Microsoft Office is installed here. This is a finding. + + + <VulnDiscussion>In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary protocols on information systems. + +Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. + +To support the requirements and principles of least functionality, the application must support the organizational requirements providing only essential capabilities and limiting the use of protocols to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. + +SQL Server using protocols deemed unsafe is open to attack through those protocols. This can allow unauthorized access to the database and through the database to other components of the information system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + To determine the protocol(s) enabled for SQL Server, open SQL Server Configuration Manager. In the left-hand pane, expand SQL Server Network Configuration. Click on the entry for the SQL Server instance under review: "Protocols for ". The right-hand pane displays the protocols enabled for the instance. + +If Named Pipes is enabled and not specifically required and authorized, this is a finding. + +If any listed protocol is enabled but not authorized, this is a finding. + + + <VulnDiscussion>To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. + +Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses, except the following: + +(i) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and +(ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals using shared accounts, for detailed accountability of individual activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review SQL Server users to determine whether shared accounts exist. (This does not include the case where SQL Server has a guest or public account that is providing access to publicly available information.) + +If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to SQL Server using a standard, shared account, ensure that it also captures the individual user identification and passes it to SQL Server. + +If individuals are not individually authenticated before using the shared account (e.g., by the operating system or possibly by an application making calls to the database), this is a finding. + +If accounts are determined to be shared, determine if they are directly accessible to end users. If so, this is a finding. + + + <VulnDiscussion>OS/enterprise authentication and identification must be used (SQL2-00-023600). Native DBMS authentication may be used only when circumstances make it unavoidable; and must be documented and AO-approved. + +The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. + +In such cases, the DoD standards for password complexity and lifetime must be implemented. DBMS products that can inherit the rules for these from the operating system or access control program (e.g., Microsoft Active Directory) must be configured to do so. For other DBMSs, the rules must be enforced using available configuration parameters or custom code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Check for use of SQL Server Authentication: + +SELECT CASE SERVERPROPERTY('IsIntegratedSecurityOnly') WHEN 1 THEN 'Windows Authentication' WHEN 0 THEN 'SQL Server Authentication' END as [Authentication Mode] + +If the returned value in the “[Authentication Mode]” column is “Windows Authentication”, this is not a finding. + +SQL Server should be configured to inherit password complexity and password lifetime rules from the operating system. + +Review SQL Server to ensure logons are created with respect to the complexity settings and password lifetime rules by running the statement: + +SELECT [name], is_expiration_checked, is_policy_checked +FROM sys.sql_logins + +Review any accounts returned by the query other than the disabled SA account, ##MS_PolicyTsqlExecutionLogin##, and ##MS_PolicyEventProcessingLogin##. + +If any account doesn't have both "is_expiration_checked" and "is_policy_checked" equal to “1”, this is a finding. + +Review the Operating System settings relating to password complexity. + +Determine whether the following rules are enforced. If any are not, this is a finding. + +Check the server operating system for password complexity: + +Navigate to Start >> All Programs >> Administrative Tools >> Local Security Policy and to review the local policies on the machine. Account Policy >> Password Policy: + +Ensure the DISA Windows Password Policy is set on the SQL Server member server. + + + <VulnDiscussion>The DoD standard for authentication is DoD-approved PKI certificates. + +Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. + +In such cases, passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. + +SQL Server passwords sent in clear text format across the network are vulnerable to discovery by unauthorized users. Disclosure of passwords may easily lead to unauthorized access to the database.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER". + +Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols for, where is a placeholder for the SQL Server instance name, and click on “Properties”. + +On the "Flags" tab, if "Force Encryption" is set to “NO", this is a finding. + +On the "Flags" tab, if "Force Encryption" is set to "YES", examine the certificate used on the "Certificate" tab. + +If it is not a DoD certificate, or if no certificate is listed, this is a finding. + +For clustered instances, the Certificate will NOT be shown in the SQL Server Configuration Manager. + +1. From a command prompt navigate to the certificate store where the Full Qualified Domain Name (FQDN) certificate is stored, by typing "certlm.msc", and pressing "ENTER". + +2. In the left side of the window, expand the "Personal" folder, and click "Certificates" + +3. Verify that the Certificate with the FQDN name is issued by the DOD. Double click the certificate, click the "Details" tab and note the value for the Thumbprint. + +4. The value for the "Thumbprint" field should match the value in the registry by running regedit and look at "HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate". + +5. This check needs to be run on each node of the cluster. + +If any nodes have a certificate in use by SQL that is not issued by DOD, this is a finding. + + + + <VulnDiscussion>Use of weak or not validated cryptographic algorithms undermines the purposes of utilizing encryption and digital signatures to protect data. Weak algorithms can be easily broken and not validated cryptographic modules may not implement algorithms correctly. Unapproved cryptographic modules or algorithms should not be relied on for authentication, confidentiality, or integrity. Weak cryptography could allow an attacker to gain access to and modify data stored in the database as well as the administration settings of SQL Server. + +Applications, including DBMSs, utilizing cryptography are required to use approved NIST FIPS 140-2 validated cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. + +The security functions validated as part of FIPS 140-2 for cryptographic modules are described in FIPS 140-2 Annex A. + +NSA Type- (where =1, 2, 3, 4) products are NSA-certified, hardware-based encryption modules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, find "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." + +If, in the "Security Setting" column, the value is "Disabled," this is a finding. + +https://support.microsoft.com/en-us/kb/955720 + + + <VulnDiscussion>One class of man-in-the-middle, or session hijacking, attack involves the adversary guessing at valid session identifiers based on patterns in identifiers already known. + +The preferred technique for thwarting guesses at Session IDs is the generation of unique session identifiers using a FIPS 140-2 approved random number generator. + +However, it is recognized that available DBMS products do not all implement the preferred technique yet may have other protections against session hijacking. Therefore, other techniques are acceptable, provided they are demonstrated to be effective.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify that Windows is configured to require the use of FIPS compliant algorithms. + +Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." + +If the Security Setting for this option is "Disabled", this is a finding. + + + <VulnDiscussion>Backup and recovery of the Service Master Key may be critical to the complete recovery of the database. Creating this backup should be one of the first administrative actions performed on the server. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review procedures for, and evidence of backup of, the Server Service Master Key in the System Security Plan. + +If the procedures or evidence does not exist, this is a finding. + +If the procedures do not indicate offline and off-site storage of the Service Master Key, this is a finding. + +If procedures do not indicate access restrictions to the Service Master Key backup, this is a finding. + + + <VulnDiscussion>Backup and recovery of the Master Key may be critical to the complete recovery of the database. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If the application owner and Authorizing Official have determined that encryption of data at rest is not required, this is not a finding. + +Review procedures for, and evidence of backup of, the Master Key in the System Security Plan. + +If the procedures or evidence does not exist, this is a finding. + +If the procedures do not indicate offline and off-site storage of the Master Key, this is a finding. + +If procedures do not indicate access restrictions to the Master Key backup, this is a finding. + + + <VulnDiscussion>If SQL Server provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages need to be carefully considered by the organization and development team. The extent to which the information system is able to identify and handle error conditions is guided by organizational policy and operational requirements. + +Some default DBMS error messages can contain information that could aid an attacker in, among others things, identifying the database type, host address, or state of the database. Custom errors may contain sensitive customer information. + +It is important that detailed error messages be visible only to those who are authorized to view them; that general users receive only generalized acknowledgment that errors have occurred; and that these generalized messages appear only when relevant to the user's task. For example, a message along the lines of, "An error has occurred. Unable to save your changes. If this problem persists, please contact your help desk." would be relevant. A message such as "Warning: your transaction generated a large number of page splits" would likely not be relevant. "ABGQ is not a valid widget code." would be appropriate; but "The INSERT statement conflicted with the FOREIGN KEY constraint "WidgetTransactionFK". The conflict occurred in database "DB7", table "dbo.WidgetMaster", column 'WidgetCode'" would not, as it reveals too much about the database structure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Error messages within applications, custom database code (stored procedures, triggers) must be enforced by guidelines and code reviews practices. + +SQL Server generates certain system events and user-defined events to the SQL Server error log. The SQL Server error log can be viewed using SQL Server Management Studio GUI. All users granted the security admin or sysadmin level of permission are able to view the logs. Review the users returned in the following script: + +USE master +GO +SELECT Name +FROM syslogins +WHERE (sysadmin = 1 or securityadmin = 1) +and hasaccess = 1; + +If any non-authorized users have access to the SQL Server Error Log located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG, this is a finding. + +In addition, the SQL Server Error Log is also located at Program Files\Microsoft SQL Server\MSSQL.n\MSSQL\LOG\. Review the permissions on this folder to ensure that only authorized users are listed. + +If any non-authorized users have access to the SQL Server Error Log in SQL Server Management Studio, this is a finding. + + + <VulnDiscussion>Organizations are required to use a central log management system, so, under normal conditions, the audit space allocated to SQL Server on its own server will not be an issue. However, space will still be required on the server for SQL Server audit records in transit, and, under abnormal conditions, this could fill up. Since a requirement exists to halt processing upon audit failure, a service outage would result. + +If support personnel are not notified immediately upon storage volume utilization reaching 75%, they are unable to plan for storage capacity expansion. + +The appropriate support staff include, at a minimum, the ISSO and the DBA/SA. + +Monitoring of free space can be accomplished using Microsoft System Center or a third-party monitoring tool.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + The operating system and SQL Server offer a number of methods for checking the drive or volume free space. Locate the destination drive where SQL Audits are stored and review system configuration. + +If no alert exist to notify support staff in the event the SQL Audit drive reaches 75%, this is a finding. + + + <VulnDiscussion>Security flaws with software applications, including database management systems, are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. + +Organization-defined time periods for updating security-relevant software may vary based on a variety of factors including, for example, the security category of the information system or the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). + +This requirement will apply to software patch management solutions that are used to install patches across the enclave and also to applications themselves that are not part of that patch management solution. For example, many browsers today provide the capability to install their own patch software. Patch criticality, as well as system criticality, will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means that the time period utilized must be a configurable parameter. Time frames for application of security-relevant software updates may be dependent upon the Information Assurance Vulnerability Management (IAVM) process. + +SQL Server will be configured to check for and install security-relevant software updates within an identified time period from the availability of the update. The specific time period will be defined by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Obtain evidence that software patches are consistently applied to SQL Server within the time frame defined for each patch. To be considered supported, Microsoft must report that the version is supported by security patches to known vulnerability. Review the Support dates at: https://support.microsoft.com/en-us/lifecycle?C2=1044 + +Check the SQL Server Version by running the following script: Print @@version + +If the SQL Server version is not shown as supported, this is a finding. + +If such evidence cannot be obtained, or the evidence that is obtained indicates a pattern of noncompliance, this is a finding. + + + <VulnDiscussion>Changes to the security configuration must be tracked. + +This requirement applies to situations where security data is retrieved or modified via data manipulation operations, as opposed to via specialized security functionality. + +In an SQL environment, types of access include, but are not necessarily limited to: +SELECT +INSERT +UPDATE +DELETE +EXECUTE</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +If the auditing the retrieval of privilege/permission/role membership information is required, execute the following query to verify the SCHEMA_OBJECT_ACCESS_GROUP is included in the server audit specification. + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_ACCESS_GROUP' + +If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is a finding. + + + <VulnDiscussion>In this context, direct access is any query, command, or call to SQL Server that comes from any source other than the application(s) that it supports. Examples would be the command line or a database management utility program. The intent is to capture all activity from administrative and non-standard sources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine whether any Server Audits are configured to filter records. From SQL Server Management Studio execute the following query: + +SELECT name AS AuditName, predicate AS AuditFilter +FROM sys.server_audits +WHERE predicate IS NOT NULL + +If any audits are returned, review the associated filters to determine whether administrative activities are being excluded. + +If any audits are configured to exclude administrative activities, this is a finding. + + + <VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. + +For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify that Windows is configured to require the use of FIPS compliant algorithms. + +Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." + +If the Security Setting for this option is "Disabled" this is a finding. + + + <VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. + +For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify that Windows is configured to require the use of FIPS 140-2 algorithms. + +Click Start >> Type "Local Security Policy" >> Press Enter >> Expand "Local Policies" >> Select "Security Options" >> Locate "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." + +If "System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding. + + + <VulnDiscussion>To prevent the compromise of authentication information, such as passwords and PINs, during the authentication process, the feedback from the information system must not provide any information that would allow an unauthorized user to compromise the authentication mechanism. + +Obfuscation of user-provided information when typed into the system is a method used in addressing this risk. + +For example, displaying asterisks when a user types in a password or PIN, is an example of obscuring feedback of authentication information. + +Database applications may allow for entry of the account name and password as a visible parameter of the application execution command. This practice must be prohibited and disabled to prevent shoulder surfing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine whether any applications that access the database allow for entry of the account name and password, or PIN. + +If any do, determine whether these applications obfuscate authentication data; if they do not, this is a finding. + + + + + <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. + +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client + False + + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 + +If this key does not exist, this is a Finding. + +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 + +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. + + 1 + DisabledByDefault + Dword + + + <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. + +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client + False + + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 + +If this key does not exist, this is a Finding. + +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 + +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. + + 1 + DisabledByDefault + Dword + + + <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. + +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client + False + + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 + +If this key does not exist, this is a Finding. + +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 + +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. + + 1 + DisabledByDefault + Dword + + + <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. + +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 3.0\Client + False + + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 + +If this key does not exist, this is a Finding. + +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 + +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. + + 1 + DisabledByDefault + Dword + + + <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. + +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server + False + + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 + +If this key does not exist, this is a Finding. + +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 + +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. + + 1 + DisabledByDefault + Dword + + + <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. + +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server + False + + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 + +If this key does not exist, this is a Finding. + +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 + +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. + + 1 + DisabledByDefault + Dword + + + <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. + +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server + False + + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 + +If this key does not exist, this is a Finding. + +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 + +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. + + 1 + DisabledByDefault + Dword + + + <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. + +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 3.0\Server + False + + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 + +If this key does not exist, this is a Finding. + +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 + +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. + + 1 + DisabledByDefault + Dword + + + <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. + +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client + False + + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 + +If this key does not exist, this is a Finding. + +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 + +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. + + 0 + Enabled + Dword + + + <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. + +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client + False + + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 + +If this key does not exist, this is a Finding. + +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 + +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. + + 0 + Enabled + Dword + + + <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. + +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client + False + + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 + +If this key does not exist, this is a Finding. + +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 + +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. + + 0 + Enabled + Dword + + + <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. + +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 3.0\Client + False + + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 + +If this key does not exist, this is a Finding. + +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 + +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. + + 0 + Enabled + Dword + + + <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. + +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server + False + + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 + +If this key does not exist, this is a Finding. + +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 + +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. + + 0 + Enabled + Dword + + + <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. + +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server + False + + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 + +If this key does not exist, this is a Finding. + +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 + +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. + + 0 + Enabled + Dword + + + <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. + +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server + False + + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 + +If this key does not exist, this is a Finding. + +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 + +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. + + 0 + Enabled + Dword + + + <VulnDiscussion>Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-2-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST SP 800-52 Rev.2 specifies the preferred configurations for government systems. + +References: +TLS Support 1.2 for SQL Server: https://support.microsoft.com/en-us/kb/3135244 +TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings +</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 3.0\Server + False + + +Access the SQL Server +Access an administrator command prompt +Type "regedit" to launch the Registry Editor + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2 + +If this key does not exist, this is a Finding. + +Verify a REG_DWORD value of "0" for "DisabledByDefault" and a value of "1" for "Enabled" for both Client and Server. + +Navigate to: +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0 +HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0 + +Under each key, verify a REG_DWORD value of "1" for "DisabledByDefault" and a value of "0" for "Enabled" for both Client and Server subkeys + +If any of the respective registry paths are non-existent or contain values other than specified above, this is a finding. If Vendor documentation supporting the configuration is provided, reduce this finding to a CAT 3. + + 0 + Enabled + Dword + + + + + <VulnDiscussion>The DoD standard for authentication is DoD-approved PKI certificates. PKI certificate-based authentication is performed by requiring the certificate holder to cryptographically prove possession of the corresponding private key. + +If the private key is stolen, an attacker can use the private key(s) to impersonate the certificate holder. In cases where SQL Server-stored private keys are used to authenticate SQL Server to the system’s clients, loss of the corresponding private keys would allow an attacker to successfully perform undetected man in the middle attacks against SQL Server system and its clients. + +Both the holder of a digital certificate and the issuing authority must take careful measures to protect the corresponding private key. Private keys should always be generated and protected in FIPS 140-2 validated cryptographic modules. + +All access to the private key(s) of SQL Server must be restricted to authorized and authenticated users. If unauthorized users have access to one or more of SQL Server's private keys, an attacker could gain access to the key(s) and use them to impersonate the database on the network or otherwise perform unauthorized actions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + System_cryptography_Use_FIPS_compliant_algorithms_for_encryption_hashing_and_signing + enabled + False + + Review system configuration to determine whether FIPS 140-2 support has been enabled. + +Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> Security Options + +Ensure that "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is enabled. + +If "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding. + +For more information, see https://support.microsoft.com/en-us/kb/3141890. + + + + + <VulnDiscussion>Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation for the whole time SQL Server is running.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + When Audits are enabled, they start up when the instance starts. +https://msdn.microsoft.com/en-us/library/cc280386.aspx#Anchor_2 + +Check if an audit is configured and enabled. + +Execute the following query: + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status +WHERE status_desc = 'STARTED' + +All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding. + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>Without auditing the enforcement of access restrictions against changes to configuration, it would be difficult to identify attempted attacks and an audit trail would not be available for forensic investigation for after-the-fact actions. + +Enforcement actions are the methods or mechanisms used to prevent unauthorized changes to configuration settings. Enforcement action methods may be as simple as denying access to a file based on the application of file permissions (access restriction). Audit items may consist of lists of actions blocked by access restrictions or changes identified after the fact.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_ACCESS_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + Determine if an audit is configured to capture denied actions and started by executing the following query: + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the following events are included in the server audit specification: + +APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, +AUDIT_CHANGE_GROUP, +BACKUP_RESTORE_GROUP, +DATABASE_CHANGE_GROUP, +DATABASE_OBJECT_ACCESS_GROUP, +DATABASE_OBJECT_CHANGE_GROUP, +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, +DATABASE_OWNERSHIP_CHANGE_GROUP, +DATABASE_OPERATION_GROUP, +DATABASE_PERMISSION_CHANGE_GROUP, +DATABASE_PRINCIPAL_CHANGE_GROUP, +DATABASE_PRINCIPAL_IMPERSONATION_GROUP, +DATABASE_ROLE_MEMBER_CHANGE_GROUP, +DBCC_GROUP, +LOGIN_CHANGE_PASSWORD_GROUP, +SCHEMA_OBJECT_CHANGE_GROUP, +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, +SERVER_OBJECT_CHANGE_GROUP, +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP, +SERVER_OBJECT_PERMISSION_CHANGE_GROUP, +SERVER_OPERATION_GROUP, +SERVER_PERMISSION_CHANGE_GROUP, +SERVER_PRINCIPAL_IMPERSONATION_GROUP, +SERVER_ROLE_MEMBER_CHANGE_GROUP, +SERVER_STATE_CHANGE_GROUP, +TRACE_CHANGE_GROUP + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ( +'APPLICATION_ROLE_CHANGE_PASSWORD_GROUP', +'AUDIT_CHANGE_GROUP', +'BACKUP_RESTORE_GROUP', +'DATABASE_CHANGE_GROUP', +'DATABASE_OBJECT_ACCESS_GROUP', +'DATABASE_OBJECT_CHANGE_GROUP', +'DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP', +'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP', +'DATABASE_OWNERSHIP_CHANGE_GROUP', +'DATABASE_OPERATION_GROUP', +'DATABASE_OWNERSHIP_CHANGE_GROUP', +'DATABASE_PERMISSION_CHANGE_GROUP', +'DATABASE_PRINCIPAL_CHANGE_GROUP', +'DATABASE_PRINCIPAL_IMPERSONATION_GROUP', +'DATABASE_ROLE_MEMBER_CHANGE_GROUP', +'DBCC_GROUP', +'LOGIN_CHANGE_PASSWORD_GROUP', +'SCHEMA_OBJECT_CHANGE_GROUP', +'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP', +'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP', +'SERVER_OBJECT_CHANGE_GROUP', +'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP', +'SERVER_OBJECT_PERMISSION_CHANGE_GROUP', +'SERVER_OPERATION_GROUP', +'SERVER_PERMISSION_CHANGE_GROUP', +'SERVER_PRINCIPAL_IMPERSONATION_GROUP', +'SERVER_ROLE_MEMBER_CHANGE_GROUP', +'SERVER_STATE_CHANGE_GROUP', +'TRACE_CHANGE_GROUP' +) +Order by d.audit_action_name + +If the identified groups are not returned, this is a finding. + + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_ACCESS_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. + +In an SQL environment, adding permissions is typically done via the GRANT command, or, in the negative, the DENY command.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + Check that SQL Server Audit is being used for the STIG compliant audit. +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +Execute the following query to verify the required audit actions are included in the server audit specification: + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' +,'DATABASE_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_PERMISSION_CHANGE_GROUP' +,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' +,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_PERMISSION_CHANGE_GROUP' +,'SERVER_ROLE_MEMBER_CHANGE_GROUP') + +If the any of the following audit actions are not returned in an active audit, this is a finding. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspx + + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. + +In an SQL environment, adding permissions is typically done via the GRANT command, or, in the negative, the DENY command. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + V-79259 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + Check that SQL Server Audit is being used for the STIG compliant audit. +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +Execute the following query to verify the required audit actions are included in the server audit specification: + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' +,'DATABASE_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_PERMISSION_CHANGE_GROUP' +,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' +,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_PERMISSION_CHANGE_GROUP' +,'SERVER_ROLE_MEMBER_CHANGE_GROUP') + +If the any of the following audit actions are not returned in an active audit, this is a finding. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspx + + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. + +In an SQL environment, modifying permissions is typically done via the GRANT, REVOKE, and DENY commands.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + V-79259 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + Check that SQL Server Audit is being used for the STIG compliant audit. +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +Execute the following query to verify the required audit actions are included in the server audit specification: + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' +,'DATABASE_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_PERMISSION_CHANGE_GROUP' +,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' +,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_PERMISSION_CHANGE_GROUP' +,'SERVER_ROLE_MEMBER_CHANGE_GROUP') + +If the any of the following audit actions are not returned in an active audit, this is a finding. + + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspx + + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. + +In an SQL environment, modifying permissions is typically done via the GRANT, REVOKE, and DENY commands. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + V-79259 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + Check that SQL Server Audit is being used for the STIG compliant audit. +Determine if an audit is configured and started by executing the following query. If no records are returned, this is a finding. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +Execute the following query to verify the required audit actions are included in the server audit specification: + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_OBJECT_PERMISSION_CHANGE_GROUP' +,'DATABASE_OWNERSHIP_CHANGE_GROUP' +,'DATABASE_PERMISSION_CHANGE_GROUP' +,'DATABASE_ROLE_MEMBER_CHANGE_GROUP' +,'SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP' +,'SERVER_OBJECT_PERMISSION_CHANGE_GROUP' +,'SERVER_PERMISSION_CHANGE_GROUP' +,'SERVER_ROLE_MEMBER_CHANGE_GROUP') + +If the any of the following audit actions are not returned in an active audit, this is a finding. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspx + + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + V-79141 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + Determine if an audit is configured and started by executing the following query: + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' + +If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding. + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + V-79141 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + Determine if an audit is configured and started by executing the following query: + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' + +If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding. + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. + +In an SQL environment, deleting permissions is typically done via the REVOKE or DENY command.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + V-79259 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + Check the SQL Server Audit being used for the STIG compliant audit. + +If the following events are not included, this is a finding. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspx + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. + +In an SQL environment, deleting permissions is typically done via the REVOKE or DENY command. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + V-79259 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + Check the SQL Server Audit being used for the STIG compliant audit. + +If the following events are not included, this is a finding. + +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP + +Reference: +https://msdn.microsoft.com/en-us/library/cc280663.aspx + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an event occurs, it must be logged.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + V-79141 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' + +If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding. + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an action is attempted, it must be logged. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + V-79141 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "SCHEMA_OBJECT_CHANGE_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' + +If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding. + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>For completeness of forensic analysis, it is necessary to track who/what (a user or other principal) logs on to SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (SUCCESSFUL_LOGIN_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +Execute the following query to verify the SUCCESSFUL_LOGIN_GROUP is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SUCCESSFUL_LOGIN_GROUP' + +If the "SUCCESSFUL_LOGIN_GROUP" is returned in an active audit, this is not a finding. + +If "SUCCESSFUL_LOGIN_GROUP" is not in the active audit, determine whether "Both failed and successful logins" is enabled. + +In SQL Management Studio +Right-click on the instance +>> Select "Properties" +>> Select "Security" on the left hand side +>> Check the setting for "Login auditing" + +If "Both failed and successful logins" is not selected, this is a finding. + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (SUCCESSFUL_LOGIN_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>For completeness of forensic analysis, it is necessary to track failed attempts to log on to SQL Server. While positive identification may not be possible in a case of failed authentication, as much information as possible about the incident must be captured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + V-79141 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "FAILED_LOGIN_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', + s.name AS 'SpecName', + d.audit_action_name AS 'ActionName', + d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'FAILED_LOGIN_GROUP' + +If the "FAILED_LOGIN_GROUP" is not returned in an active audit, this is a finding. + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. + +System documentation should include a definition of the functionality considered privileged. + +A privileged function in this context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to: +CREATE +ALTER +DROP +GRANT +REVOKE +DENY + +There may also be Data Manipulation Language (DML) statements that, subject to context, should be regarded as privileged. Possible examples in SQL include: + +TRUNCATE TABLE; +DELETE, or +DELETE affecting more than n rows, for some n, or +DELETE without a WHERE clause; + +UPDATE or +UPDATE affecting more than n rows, for some n, or +UPDATE without a WHERE clause; + +any SELECT, INSERT, UPDATE, or DELETE to an application-defined security table executed by other than a security principal. + +Depending on the capabilities of SQL Server and the design of the database and associated applications, audit logging may be achieved by means of DBMS auditing features, database triggers, other mechanisms, or a combination of these. + +Note that it is particularly important to audit, and tightly control, any action that weakens the implementation of this requirement itself, since the objective is to have a complete audit trail of all administrative activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + Determine if an audit is configured and started by executing the following query: + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the following events are included in the server audit specification: + +APPLICATION_ROLE_CHANGE_PASSWORD_GROUP +AUDIT_CHANGE_GROUP +BACKUP_RESTORE_GROUP +DATABASE_CHANGE_GROUP +DATABASE_OBJECT_CHANGE_GROUP +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OPERATION_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_PRINCIPAL_CHANGE_GROUP +DATABASE_PRINCIPAL_IMPERSONATION_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +DBCC_GROUP +LOGIN_CHANGE_PASSWORD_GROUP +SCHEMA_OBJECT_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OPERATION_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_PRINCIPAL_CHANGE_GROUP +SERVER_PRINCIPAL_IMPERSONATION_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP +SERVER_STATE_CHANGE_GROUP +TRACE_CHANGE_GROUP +USER_CHANGE_PASSWORD_GROUP + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHANGE_GROUP','BACKUP_RESTORE_GROUP','DATABASE_CHANGE_GROUP','DATABASE_OBJECT_CHANGE_GROUP','DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP','DATABASE_OBJECT_PERMISSION_CHANGE_GROUP','DATABASE_OPERATION_GROUP','DATABASE_OWNERSHIP_CHANGE_GROUP','DATABASE_PERMISSION_CHANGE_GROUP','DATABASE_PRINCIPAL_CHANGE_GROUP','DATABASE_PRINCIPAL_IMPERSONATION_GROUP','DATABASE_ROLE_MEMBER_CHANGE_GROUP','DBCC_GROUP','LOGIN_CHANGE_PASSWORD_GROUP','SCHEMA_OBJECT_CHANGE_GROUP','SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP','SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OBJECT_CHANGE_GROUP','SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP','SERVER_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OPERATION_GROUP','SERVER_PERMISSION_CHANGE_GROUP','SERVER_PRINCIPAL_CHANGE_GROUP','SERVER_PRINCIPAL_IMPERSONATION_GROUP','SERVER_ROLE_MEMBER_CHANGE_GROUP','SERVER_STATE_CHANGE_GROUP','TRACE_CHANGE_GROUP','USER_CHANGE_PASSWORD_GROUP') + +If the identified groups are not returned, this is a finding. + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. + +System documentation should include a definition of the functionality considered privileged. + +A privileged function in this context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to: +CREATE +ALTER +DROP +GRANT +REVOKE +DENY + +Note that it is particularly important to audit, and tightly control, any action that weakens the implementation of this requirement itself, since the objective is to have a complete audit trail of all administrative activity. + +To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(LOGOUT_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP),(LOGOUT_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the following events are included in the server audit specification: + +APPLICATION_ROLE_CHANGE_PASSWORD_GROUP +AUDIT_CHANGE_GROUP +BACKUP_RESTORE_GROUP +DATABASE_CHANGE_GROUP +DATABASE_OBJECT_CHANGE_GROUP +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OPERATION_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_PRINCIPAL_CHANGE_GROUP +DATABASE_PRINCIPAL_IMPERSONATION_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +DBCC_GROUP +LOGIN_CHANGE_PASSWORD_GROUP +LOGOUT_GROUP +SCHEMA_OBJECT_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OPERATION_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_PRINCIPAL_CHANGE_GROUP +SERVER_PRINCIPAL_IMPERSONATION_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP +SERVER_STATE_CHANGE_GROUP +TRACE_CHANGE_GROUP +USER_CHANGE_PASSWORD_GROUP + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHANGE_GROUP','BACKUP_RESTORE_GROUP','DATABASE_CHANGE_GROUP','DATABASE_OBJECT_CHANGE_GROUP','DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP','DATABASE_OBJECT_PERMISSION_CHANGE_GROUP','DATABASE_OPERATION_GROUP','DATABASE_OWNERSHIP_CHANGE_GROUP','DATABASE_PERMISSION_CHANGE_GROUP','DATABASE_PRINCIPAL_CHANGE_GROUP','DATABASE_PRINCIPAL_IMPERSONATION_GROUP','DATABASE_ROLE_MEMBER_CHANGE_GROUP','DBCC_GROUP','LOGIN_CHANGE_PASSWORD_GROUP',’ LOGOUT_GROUP’,'SCHEMA_OBJECT_CHANGE_GROUP','SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP','SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OBJECT_CHANGE_GROUP','SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP','SERVER_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OPERATION_GROUP','SERVER_PERMISSION_CHANGE_GROUP','SERVER_PRINCIPAL_CHANGE_GROUP','SERVER_PRINCIPAL_IMPERSONATION_GROUP','SERVER_ROLE_MEMBER_CHANGE_GROUP','SERVER_STATE_CHANGE_GROUP','TRACE_CHANGE_GROUP','USER_CHANGE_PASSWORD_GROUP') + +If the identified groups are not returned, this is a finding. + + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(LOGOUT_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP),(LOGOUT_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>For completeness of forensic analysis, it is necessary to know how long a user's (or other principal's) connection to SQL Server lasts. This can be achieved by recording disconnections, in addition to logons/connections, in the audit logs. + +Disconnection may be initiated by the user or forced by the system (as in a timeout) or result from a system or network failure. To the greatest extent possible, all disconnections must be logged.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + V-79293 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(LOGOUT_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP),(LOGOUT_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + Determine if an audit is configured and started by executing the following query: + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the following events are included in the server audit specification: + +APPLICATION_ROLE_CHANGE_PASSWORD_GROUP +AUDIT_CHANGE_GROUP +BACKUP_RESTORE_GROUP +DATABASE_CHANGE_GROUP +DATABASE_OBJECT_CHANGE_GROUP +DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP +DATABASE_OBJECT_PERMISSION_CHANGE_GROUP +DATABASE_OPERATION_GROUP +DATABASE_OWNERSHIP_CHANGE_GROUP +DATABASE_PERMISSION_CHANGE_GROUP +DATABASE_PRINCIPAL_CHANGE_GROUP +DATABASE_PRINCIPAL_IMPERSONATION_GROUP +DATABASE_ROLE_MEMBER_CHANGE_GROUP +DBCC_GROUP +LOGIN_CHANGE_PASSWORD_GROUP +LOGOUT_GROUP +SCHEMA_OBJECT_CHANGE_GROUP +SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP +SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OBJECT_CHANGE_GROUP +SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP +SERVER_OBJECT_PERMISSION_CHANGE_GROUP +SERVER_OPERATION_GROUP +SERVER_PERMISSION_CHANGE_GROUP +SERVER_PRINCIPAL_CHANGE_GROUP +SERVER_PRINCIPAL_IMPERSONATION_GROUP +SERVER_ROLE_MEMBER_CHANGE_GROUP +SERVER_STATE_CHANGE_GROUP +TRACE_CHANGE_GROUP +USER_CHANGE_PASSWORD_GROUP + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 +AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHANGE_GROUP','BACKUP_RESTORE_GROUP','DATABASE_CHANGE_GROUP','DATABASE_OBJECT_CHANGE_GROUP','DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP','DATABASE_OBJECT_PERMISSION_CHANGE_GROUP','DATABASE_OPERATION_GROUP','DATABASE_OWNERSHIP_CHANGE_GROUP','DATABASE_PERMISSION_CHANGE_GROUP','DATABASE_PRINCIPAL_CHANGE_GROUP','DATABASE_PRINCIPAL_IMPERSONATION_GROUP','DATABASE_ROLE_MEMBER_CHANGE_GROUP','DBCC_GROUP','LOGIN_CHANGE_PASSWORD_GROUP',’ LOGOUT_GROUP’,'SCHEMA_OBJECT_CHANGE_GROUP','SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP','SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OBJECT_CHANGE_GROUP','SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP','SERVER_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OPERATION_GROUP','SERVER_PERMISSION_CHANGE_GROUP','SERVER_PRINCIPAL_CHANGE_GROUP','SERVER_PRINCIPAL_IMPERSONATION_GROUP','SERVER_ROLE_MEMBER_CHANGE_GROUP','SERVER_STATE_CHANGE_GROUP','TRACE_CHANGE_GROUP','USER_CHANGE_PASSWORD_GROUP') + +If the identified groups are not returned, this is a finding. + + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(LOGOUT_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP),(LOGOUT_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>For completeness of forensic analysis, it is necessary to track who logs on to SQL Server. + +Concurrent connections by the same user from multiple workstations may be valid use of the system; or such connections may be due to improper circumvention of the requirement to use the CAC for authentication; or they may indicate unauthorized account sharing; or they may be because an account has been compromised. + +(If the fact of multiple, concurrent logons by a given user can be reliably reconstructed from the log entries for other events (logons/connections; voluntary and involuntary disconnections), then it is not mandatory to create additional log entries specifically for this.)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + V-79141 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + False + False + + Determine if an audit is configured and started by executing the following query. + +SELECT name AS 'Audit Name', + status_desc AS 'Audit Status', + audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status + +If no records are returned, this is a finding. + +Execute the following query to verify the "SUCCESSFUL_LOGIN_GROUP" is included in the server audit specification. + +SELECT a.name AS 'AuditName', +s.name AS 'SpecName', +d.audit_action_name AS 'ActionName', +d.audited_result AS 'Result' +FROM sys.server_audit_specifications s +JOIN sys.server_audits a ON s.audit_guid = a.audit_guid +JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.server_specification_id +WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SUCCESSFUL_LOGIN_GROUP' + +If the "SUCCESSFUL_LOGIN_GROUP" is returned in an active audit, this is not a finding. + +If "SUCCESSFUL_LOGIN_GROUP" is not in the active audit, determine whether "Both failed and successful logins" is enabled. + +In SQL Management Studio: +Right-click on the instance >> Select "Properties" >> Select "Security" on the left hand side >> Check the setting for "Login auditing" + +If "Both failed and successful logins" is not selected, this is a finding. + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + + + + + <VulnDiscussion>SQL Server's [sa] account has special privileges required to administer the database. The [sa] account is a well-known SQL Server account and is likely to be targeted by attackers and thus more prone to providing unauthorized access to the database. + +This [sa] default account is administrative and could lead to catastrophic consequences, including the complete loss of control over SQL Server. If the [sa] default account is not disabled, an attacker might be able to gain access through the account. SQL Server by default, at installation, disables the [sa] account. + +Some applications that run on SQL Server require the [sa] account to be enabled in order for the application to function properly. These applications that require the [sa] account to be enabled are usually legacy systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled <> 1; + False + False + + Check SQL Server settings to determine if the [sa] (system administrator) account has been disabled by executing the following query: + +USE master; +GO +SELECT name, is_disabled +FROM sys.sql_logins +WHERE principal_id = 1; +GO + +Verify that the "name" column contains the current name of the [sa] database server account. + +If the "is_disabled" column is not set to “1”, this is a finding. + USE [master] DECLARE @SysAdminAccountName varchar(50), @cmd NVARCHAR(100), @saDisabled int SET @SysAdminAccountName = (SELECT name FROM sys.sql_logins WHERE principal_id = 1) SELECT @cmd = N'ALTER LOGIN ['+@SysAdminAccountName+'] DISABLE;' SET @saDisabled = (SELECT is_disabled FROM sys.sql_logins WHERE principal_id = 1) IF @saDisabled <> 1 exec sp_executeSQL @cmd; + USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled <> 1; + + + + + <VulnDiscussion>SQL Server's [sa] account has special privileges required to administer the database. The [sa] account is a well-known SQL Server account name and is likely to be targeted by attackers, and is thus more prone to providing unauthorized access to the database. + +Since the SQL Server [sa] is administrative in nature, the compromise of a default account can have catastrophic consequences, including the complete loss of control over SQL Server. Since SQL Server needs for this account to exist and it should not be removed, one way to mitigate this risk is to change the [sa] account name.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + V-79317 + USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled <> 1; + False + False + + Verify the SQL Server default [sa] (system administrator) account name has been changed by executing the following query: + +USE master; +GO +SELECT * +FROM sys.sql_logins +WHERE [name] = 'sa' OR [principal_id] = 1; +GO + +If the login account name "SA" or "sa" appears in the query output, this is a finding. + USE [master] DECLARE @SysAdminAccountName varchar(50), @cmd NVARCHAR(100), @saDisabled int SET @SysAdminAccountName = (SELECT name FROM sys.sql_logins WHERE principal_id = 1) SELECT @cmd = N'ALTER LOGIN ['+@SysAdminAccountName+'] DISABLE;' SET @saDisabled = (SELECT is_disabled FROM sys.sql_logins WHERE principal_id = 1) IF @saDisabled <> 1 exec sp_executeSQL @cmd; + USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled <> 1; + + + + + From a0b116f951e48fd2ddcaa96434ac1da7c291ea44 Mon Sep 17 00:00:00 2001 From: Steve Hose Date: Mon, 2 Dec 2019 15:58:28 -0500 Subject: [PATCH 14/42] Code changes to correct issues --- Module/STIG/Functions.Checklist.ps1 | 263 +++++++++++++++++++++++++--- 1 file changed, 238 insertions(+), 25 deletions(-) diff --git a/Module/STIG/Functions.Checklist.ps1 b/Module/STIG/Functions.Checklist.ps1 index 5ae883168..79529288a 100644 --- a/Module/STIG/Functions.Checklist.ps1 +++ b/Module/STIG/Functions.Checklist.ps1 @@ -47,17 +47,24 @@ function New-StigCheckList [string] $XccdfPath, - [Parameter(Mandatory = $true)] - [string] - $ManualCheckFile, - [Parameter(Mandatory = $true)] [System.IO.FileInfo] - $OutputPath + $OutputPath, + [Parameter()] + [String] + $ManualCheckFile ) - $manualCheckData = Invoke-Expression (Get-Content $manualCheckFile | Out-String) + # Validate parameters before continuing + if ($ManualCheckFile) + { + if (-not (Test-Path -Path $ManualCheckFile)) + { + throw "$($ManualCheckFile) is not a valid path to a ManualCheckFile. Provide a full valid path" + } + $manualCheckData = Import-PowerShellDataFile -path $ManualCheckFile + } if (-not (Test-Path -Path $OutputPath.DirectoryName)) { @@ -69,6 +76,54 @@ function New-StigCheckList throw "$($OutputPath.FullName) is not a valid checklist extension. Please provide a full valid path ending in .ckl" } + # Values for some of these fields can be read from the .mof file or the DSC results file + if ($PSCmdlet.ParameterSetName -eq 'mof') + { + if (-not (Test-Path -Path $ReferenceConfiguration)) + { + throw "$($ReferenceConfiguration) is not a valid path to a configuration (.mof) file. Please provide a valid entry." + } + + $MofString = Get-Content -Path $ReferenceConfiguration -Raw + $TargetNode = Get-TargetNodeFromMof($MofString) + + } + elseif ($PSCmdlet.ParameterSetName -eq 'result') + { + # Check the returned object + if ($null -eq $DscResult) + { + throw 'Passed in $DscResult parameter is null. Please provide a valid result using Test-DscConfiguration.' + } + $TargetNode = $DscResult.PSComputerName + } + + $TargetNodeType = Get-TargetNodeType($TargetNode) + + switch ($TargetNodeType) + { + "MACAddress" + { + $HostnameMACAddress = $TargetNode + } + "IPv4Address" + { + $HostnameIPAddress = $TargetNode + } + "IPv6Address" + { + $HostnameIPAddress = $TargetNode + } + "FQDN" + { + $HostnameFQDN = $TargetNode + } + default + { + $Hostname = $TargetNode + } + } + $xmlWriterSettings = [System.Xml.XmlWriterSettings]::new() $xmlWriterSettings.Indent = $true $xmlWriterSettings.IndentChars = "`t" @@ -81,17 +136,13 @@ function New-StigCheckList $writer.WriteStartElement("ASSET") - # Values for some of these fields can be read from the .mof file or the DSC results file - - Get-TargetNodeFromMof - $assetElements = [ordered] @{ 'ROLE' = 'None' 'ASSET_TYPE' = 'Computing' - 'HOST_NAME' = '' - 'HOST_IP' = '' - 'HOST_MAC' = '' - 'HOST_FQDN' = '' + 'HOST_NAME' = "$Hostname" + 'HOST_IP' = "$HostnameIPAddress" + 'HOST_MAC' = "$HostnameMACAddress" + 'HOST_FQDN' = "$HostnameFQDN" 'TECH_AREA' = '' 'TARGET_KEY' = '2350' 'WEB_OR_DATABASE' = 'false' @@ -197,6 +248,8 @@ function New-StigCheckList if ($setting) { $status = $statusMap['NotAFinding'] + $comments = "To be addressed by PowerStig MOF via $setting" + $findingDetails = Get-FindingDetails -Setting $setting } elseif ($manualCheck) @@ -216,9 +269,11 @@ function New-StigCheckList if ($setting) { - if ($setting.InDesiredState) + if ($setting.ResourcesInDesiredState) { $status = $statusMap['NotAFinding'] + $comments = "Addressed by PowerStig MOF via $setting" + $findingDetails = Get-FindingDetails -Setting $setting } elseif ($manualCheck) { @@ -229,8 +284,6 @@ function New-StigCheckList { $status = $statusMap['Open'] } - - $comments = 'Managed via PowerStigDsc from Live call' } else { @@ -243,7 +296,7 @@ function New-StigCheckList $writer.WriteEndElement(<#STATUS#>) $writer.WriteStartElement("FINDING_DETAILS") - $writer.WriteString((Get-FindingDetails -Setting $setting)) + $writer.WriteString($findingDetails) $writer.WriteEndElement(<#FINDING_DETAILS#>) $writer.WriteStartElement("COMMENTS") @@ -430,31 +483,145 @@ function Get-FindingDetails switch ($setting.ResourceID) { + {$PSItem -match "^\[AccountPolicy\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[ActiveDirectoryAuditRuleEntry\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[AuditPolicySubcategory\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[AuditSetting\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[FileSystemAuditRuleEntry\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[KeyValuePairFile\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[None\]"} + { + return "No DSC resource was leveraged for this rule (Resource=None)" + } + {$PSItem -match "^\[NTFSAccessEntry\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[ProcessMitigation\]"} + { + return Get-FindingDetailsString -Setting $setting + } {$PSItem -match "^\[(x)?Registry\]"} { return "Registry Value = $($setting.ValueData)" } - {$PSItem -match "^\[AuditPolicySubcategory\]"} + {$PSItem -match "^\[RegistryAccessEntry\]"} { - return "AuditPolicySubcategory AuditFlag = $($setting.AuditFlag)" + return Get-FindingDetailsString -Setting $setting } - {$PSItem -match "^\[AccountPolicy\]"} + {$PSItem -match "^\[RegistryPolicyFile\]"} { - return "AccountPolicy = Needs work" + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[ReplaceText\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[Script\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[SecurityOption\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[Service\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[SqlScriptQuery\]"} + { + return Get-FindingDetailsString -Setting $setting } {$PSItem -match "^\[UserRightsAssignment\]"} { return "UserRightsAssignment Identity = $($setting.Identity)" } - {$PSItem -match "^\[SecurityOption\]"} + {$PSItem -match "^\[WindowsFeature\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[WindowsOptionalFeature\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[xDnsServerSetting\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[xIisMimeTypeMapping\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[xSslSettings\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[xWebAppPool\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[xWebConfigKeyValue\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[XWebsite\]"} + { + return Get-FindingDetailsString -Setting $setting + } + {$PSItem -match "^\[xWinEventLog\]"} { - return "SecurityOption = Needs work" + return Get-FindingDetailsString -Setting $setting } default { - return "not found" + return "DSC Resource details not found." + } + } +} +function Get-FindingDetailsString +{ + [OutputType([string])] + [CmdletBinding()] + param + ( + [Parameter(Mandatory)] + [AllowNull()] + [psobject] + $Setting + ) + + foreach ($property in $setting.PSobject.properties) { + $lineCount += 1 + if($linecount -le 2){ + $returnString += $($property.Name) + ' = ' + $returnString += $($setting.PSobject.properties[$property.Name].Value) + "`n" } } + + if ($null -eq $returnString) + { + $returnString = $setting.ResourceID + ' automatically applied/to be applied by PowerStig MOF.' + } + return $returnString } function Get-TargetNodeFromMof { @@ -471,4 +638,50 @@ function Get-TargetNodeFromMof $TargetNodeSearch = $mofstring | Select-String -Pattern $pattern $TargetNode = $TargetNodeSearch.matches.value return $TargetNode +} +function Get-TargetNodeType +{ + [OutputType([string])] + [CmdletBinding()] + param + ( + [Parameter(Mandatory)] + [string] + $TargetNode + ) + + switch ($TargetNode) + { + # Do we have a MAC address? + { + $_ -match '(([0-9a-f]{2}:){5}[0-9a-f]{2})' + } + { + return 'MACAddress' + } + + # Do we have an IPv6 address? + { + $_ -match '(([0-9a-f]{0,4}:){7}[0-9a-f]{0,4})' + } + { + return 'IPv4Address' + } + + # Do we have an IPv4 address? + { + $_ -match '(([0-9]{1,3}\.){3}[0-9]{1,3})' + } + { + return 'IPv6Address' + } + + # Do we have a Fully-qualified Domain Name? + { + $_ -match '([a-zA-Z0-9-.\+]{2,256}\.[a-z]{2,256}\b)' + } + { + return 'FQDN' + } + } } \ No newline at end of file From 9270c1a883660401a6ff4b94fbc880d7587f5c74 Mon Sep 17 00:00:00 2001 From: Eric Jenkins Date: Tue, 3 Dec 2019 14:42:22 -0500 Subject: [PATCH 15/42] Updated JRE rule V-66941.a to be a org setting (#543) * updated JRE rule V-66941.a to be a org settings * updated name of processed STIG * update changelog * added space to TS build issue. --- CHANGELOG.md | 1 + ...e_JRE_8_Windows_STIG_V1R5_Manual-xccdf.log | 2 + .../Processed/OracleJRE-8-1.5.org.default.xml | 5 ++- StigData/Processed/OracleJRE-8-1.5.xml | 39 ++++++++++++++++--- ...RightsAssignmentRule.Integration.tests.ps1 | 2 +- 5 files changed, 41 insertions(+), 8 deletions(-) create mode 100644 StigData/Archive/OracleJRE/U_Oracle_JRE_8_Windows_STIG_V1R5_Manual-xccdf.log diff --git a/CHANGELOG.md b/CHANGELOG.md index 395381231..67f58c985 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## Unreleased +* Fixed [#428](https://github.com/microsoft/PowerStig/issues/428): Updated JRE rule V-66941.a to be a Organizational setting * Update PowerSTIG parsing for IIS 8.5 STIG - Ver 1, Rel 9 [#530] (https://github.com/microsoft/PowerStig/issues/530) * Fixed [#427](https://github.com/microsoft/PowerStig/issues/427): Windows 10 Rule V-63373 fails to apply settings to system drive * Fixed [#514](https://github.com/microsoft/PowerStig/issues/514): Feature request: additional support for servicerule properties diff --git a/StigData/Archive/OracleJRE/U_Oracle_JRE_8_Windows_STIG_V1R5_Manual-xccdf.log b/StigData/Archive/OracleJRE/U_Oracle_JRE_8_Windows_STIG_V1R5_Manual-xccdf.log new file mode 100644 index 000000000..cf7c7d5db --- /dev/null +++ b/StigData/Archive/OracleJRE/U_Oracle_JRE_8_Windows_STIG_V1R5_Manual-xccdf.log @@ -0,0 +1,2 @@ +V-66941::*::HardCodedRule(FileContentRule)@{DscResource = 'KeyValuePairFile'; Key = 'deployment.system.config'; Value = $null;OrganizationValueRequired = 'true'; OrganizationValueTestString = 'Value has the path to config file such as "file:///C:/Windows/Java/Deployment/deployment.properties"'}HardCodedRule(FileContentRule)@{DscResource = 'KeyValuePairFile'; Key = 'deployment.system.config.mandatory'; Value = 'true'} + diff --git a/StigData/Processed/OracleJRE-8-1.5.org.default.xml b/StigData/Processed/OracleJRE-8-1.5.org.default.xml index 536cd644c..5c0880fcb 100644 --- a/StigData/Processed/OracleJRE-8-1.5.org.default.xml +++ b/StigData/Processed/OracleJRE-8-1.5.org.default.xml @@ -5,4 +5,7 @@ Each setting in this file is linked by STIG ID and the valid range is in an associated comment. --> - + + + + diff --git a/StigData/Processed/OracleJRE-8-1.5.xml b/StigData/Processed/OracleJRE-8-1.5.xml index fbdd97309..54b90ec68 100644 --- a/StigData/Processed/OracleJRE-8-1.5.xml +++ b/StigData/Processed/OracleJRE-8-1.5.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>Certificates may be revoked due to improper issuance, compromise of the certificate, and failure to adhere to policy. Therefore, any certificate found revoked on a CRL or via Online Certificate Status Protocol (OCSP) should not be trusted. Permitting execution of an applet published with a revoked certificate may result in spoofing, malware, system modification, invasion of privacy, and denial of service. @@ -35,10 +35,24 @@ If the value of the "deployment.system.config.mandatory" key is TRUE and if the False deployment.system.config - False - - "deployment.system.config=file:///C:/Windows/Java/Deployment/deployment.properties" - file:///C:/Windows/Java/Deployment/deployment.properties + True + Value has the path to config file such as "file:///C:/Windows/Java/Deployment/deployment.properties" + Navigate to the "deployment.config" file for Java: + +<Windows Directory>\Sun\Java\Deployment\deployment.config +- or - +<JRE Installation Directory>\Lib\deployment.config + +The "deployment.config" file contains two properties: deployment.system.config and deployment.system.config.mandatory. + +The "deployment.system.config" key points to the location of the "deployment.properties" file. The location is variable. It can point to a file on the local disk or a UNC path. The following is an example: +"deployment.system.config=file:///C:/Windows/Java/Deployment/deployment.properties" + +If the "deployment.system.config" key does not exist or does not point to the location of the "deployment.properties" file, this is a finding. + +If the "deployment.system.config.mandatory" key does not exist or is set to "false", this is a finding. + + <VulnDiscussion>The deployment.config configuration file contains two keys. @@ -53,7 +67,20 @@ If the value of the "deployment.system.config.mandatory" key is TRUE and if the deployment.system.config.mandatory False - If the "deployment.system.config.mandatory" key does not exist or is set to "false", this is a finding. + Navigate to the "deployment.config" file for Java: + +<Windows Directory>\Sun\Java\Deployment\deployment.config +- or - +<JRE Installation Directory>\Lib\deployment.config + +The "deployment.config" file contains two properties: deployment.system.config and deployment.system.config.mandatory. + +The "deployment.system.config" key points to the location of the "deployment.properties" file. The location is variable. It can point to a file on the local disk or a UNC path. The following is an example: +"deployment.system.config=file:///C:/Windows/Java/Deployment/deployment.properties" + +If the "deployment.system.config" key does not exist or does not point to the location of the "deployment.properties" file, this is a finding. + +If the "deployment.system.config.mandatory" key does not exist or is set to "false", this is a finding. true diff --git a/Tests/Integration/UserRightsAssignmentRule.Integration.tests.ps1 b/Tests/Integration/UserRightsAssignmentRule.Integration.tests.ps1 index bb0bbf5c4..be853f160 100644 --- a/Tests/Integration/UserRightsAssignmentRule.Integration.tests.ps1 +++ b/Tests/Integration/UserRightsAssignmentRule.Integration.tests.ps1 @@ -9,7 +9,7 @@ try displayName = 'Act as part of the operating system' constant = 'SeTcbPrivilege' Identity = 'NULL' - organizationValueRequired = $false + organizationValueRequired = $false organizationValueTestString = $null CheckContent = 'Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". From 1c3d1e0e43487b254954aaec47dfd6a5ac2d52d1 Mon Sep 17 00:00:00 2001 From: Steve Hose Date: Wed, 4 Dec 2019 17:17:40 -0500 Subject: [PATCH 16/42] Updates to add functionality and address bugs --- Module/STIG/Functions.Checklist.ps1 | 126 +++++----------------------- 1 file changed, 21 insertions(+), 105 deletions(-) diff --git a/Module/STIG/Functions.Checklist.ps1 b/Module/STIG/Functions.Checklist.ps1 index 79529288a..7c402b5de 100644 --- a/Module/STIG/Functions.Checklist.ps1 +++ b/Module/STIG/Functions.Checklist.ps1 @@ -63,7 +63,7 @@ function New-StigCheckList { throw "$($ManualCheckFile) is not a valid path to a ManualCheckFile. Provide a full valid path" } - $manualCheckData = Import-PowerShellDataFile -path $ManualCheckFile + $manualCheckData = Invoke-Expression (Get-Content $manualCheckFile | Out-String) } if (-not (Test-Path -Path $OutputPath.DirectoryName)) @@ -212,6 +212,7 @@ function New-StigCheckList foreach ($attribute in $vulnerability.GetEnumerator()) { $status = $null + $findingDetails = $null $comments = $null $manualCheck = $null @@ -255,6 +256,7 @@ function New-StigCheckList elseif ($manualCheck) { $status = $statusMap["$($manualCheck.Status)"] + $findingDetails = $manualCheck.Details $comments = $manualCheck.Comments } else @@ -278,6 +280,7 @@ function New-StigCheckList elseif ($manualCheck) { $status = $statusMap["$($manualCheck.Status)"] + $findingDetails = $manualCheck.Details $comments = $manualCheck.Comments } else @@ -291,6 +294,19 @@ function New-StigCheckList } } + # Test to see if this rule is managed as a duplicate + $convertedRule = $global:stigSettings | where-object Id -eq $vid + if ($convertedRule.DuplicateOf) + { + # How is the duplicate rule handled? If it is handled, then the duplicate is also covered + $originalSetting = Get-SettingsFromMof -ReferenceConfiguration $referenceConfiguration -Id $convertedRule.DuplicateOf + if ($originalSetting) + { + $status = $statusMap['NotAFinding'] + $comments = 'Managed via PowerStigDsc - this rule is a duplicate of ' + $convertedRule.DuplicateOf + } + } + $writer.WriteStartElement("STATUS") $writer.WriteString($status) $writer.WriteEndElement(<#STATUS#>) @@ -483,117 +499,22 @@ function Get-FindingDetails switch ($setting.ResourceID) { - {$PSItem -match "^\[AccountPolicy\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[ActiveDirectoryAuditRuleEntry\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[AuditPolicySubcategory\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[AuditSetting\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[FileSystemAuditRuleEntry\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[KeyValuePairFile\]"} - { - return Get-FindingDetailsString -Setting $setting - } + # Only add custom entries if specific output is more valuable than dumping all properties {$PSItem -match "^\[None\]"} { return "No DSC resource was leveraged for this rule (Resource=None)" } - {$PSItem -match "^\[NTFSAccessEntry\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[ProcessMitigation\]"} - { - return Get-FindingDetailsString -Setting $setting - } {$PSItem -match "^\[(x)?Registry\]"} { return "Registry Value = $($setting.ValueData)" } - {$PSItem -match "^\[RegistryAccessEntry\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[RegistryPolicyFile\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[ReplaceText\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[Script\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[SecurityOption\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[Service\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[SqlScriptQuery\]"} - { - return Get-FindingDetailsString -Setting $setting - } {$PSItem -match "^\[UserRightsAssignment\]"} { return "UserRightsAssignment Identity = $($setting.Identity)" } - {$PSItem -match "^\[WindowsFeature\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[WindowsOptionalFeature\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[xDnsServerSetting\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[xIisMimeTypeMapping\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[xSslSettings\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[xWebAppPool\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[xWebConfigKeyValue\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[XWebsite\]"} - { - return Get-FindingDetailsString -Setting $setting - } - {$PSItem -match "^\[xWinEventLog\]"} - { - return Get-FindingDetailsString -Setting $setting - } default { - return "DSC Resource details not found." + return Get-FindingDetailsString -Setting $setting } } } @@ -610,17 +531,12 @@ function Get-FindingDetailsString ) foreach ($property in $setting.PSobject.properties) { - $lineCount += 1 - if($linecount -le 2){ + if ($property.TypeNameOfValue -Match 'String') + { $returnString += $($property.Name) + ' = ' $returnString += $($setting.PSobject.properties[$property.Name].Value) + "`n" } } - - if ($null -eq $returnString) - { - $returnString = $setting.ResourceID + ' automatically applied/to be applied by PowerStig MOF.' - } return $returnString } function Get-TargetNodeFromMof From 583fbc6e23a5bf0d6cdc3a294919e10c9ad5f721 Mon Sep 17 00:00:00 2001 From: Brian Wilhite Date: Fri, 6 Dec 2019 15:43:33 -0500 Subject: [PATCH 17/42] Need a test to verify the conversionstatus="fail" does not exist in processed STIGs (#550) * updated Win2016DC failed converts and added tests * removed V-73517 from MS-1.9 as the rule no longer exist. --- CHANGELOG.md | 2 + ..._Server_2016_DC_STIG_V1R8_Manual-xccdf.log | 7 + ..._Server_2016_DC_STIG_V1R9_Manual-xccdf.log | 6 + .../Processed/WindowsServer-2016-DC-1.8.xml | 2470 +++++++---------- .../WindowsServer-2016-DC-1.9.org.default.xml | 2 - .../Processed/WindowsServer-2016-DC-1.9.xml | 2096 ++++++-------- .../WindowsServer-2016-MS-1.9.org.default.xml | 2 - Tests/Unit/Module/STIG.tests.ps1 | 8 +- 8 files changed, 1952 insertions(+), 2641 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 67f58c985..3048220c9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## Unreleased +* Update PowerSTIG parsing for IIS 8.5 STIG - Ver 1, Rel 9 [#530](https://github.com/microsoft/PowerStig/issues/530) * Fixed [#428](https://github.com/microsoft/PowerStig/issues/428): Updated JRE rule V-66941.a to be a Organizational setting * Update PowerSTIG parsing for IIS 8.5 STIG - Ver 1, Rel 9 [#530] (https://github.com/microsoft/PowerStig/issues/530) * Fixed [#427](https://github.com/microsoft/PowerStig/issues/427): Windows 10 Rule V-63373 fails to apply settings to system drive @@ -12,6 +13,7 @@ * Update PowerSTIG to successfully parse Mozilla Firefox STIG - Ver 4, Rel 27: [#540](https://github.com/microsoft/PowerStig/issues/540) * Update PowerSTIG to successfully parse Microsoft Windows 10 STIG - Ver 1, Rel 19: [533](https://github.com/microsoft/PowerStig/issues/533) * Update PowerSTIG to parse/convert the Windows Server 2012 R2 MS/DC V2R17/V2R18 Respectively: [531](https://github.com/microsoft/PowerStig/issues/531) +* Need a test to verify the conversionstatus="fail" does not exist in processed STIGs: [545](https://github.com/microsoft/PowerStig/issues/545) * Update PowerSTIG to successfully parse Microsoft SQL Server 2016 Instance STIG - Ver 1, Rel 7: [#542](https://github.com/microsoft/PowerStig/issues/542) ## 4.1.1 diff --git a/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R8_Manual-xccdf.log b/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R8_Manual-xccdf.log index 2fe57ecd4..dd14acdef 100644 --- a/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R8_Manual-xccdf.log +++ b/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R8_Manual-xccdf.log @@ -11,3 +11,10 @@ V-73591::Registry Path: \SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptB V-73551::Value: 0x00000000 (0) (Security), 0x00000001 (1) (Basic)::Value: 0x00000000 (0) (Security) or 0x00000001 (1) (Basic) V-73711::Value: 0x00000002 (2) (Prompt for consent on the secure desktop)::Value: 1 or 2 V-73755::Passwords for application accounts with this user right must be protected as highly privileged accounts.::"" +V-73375::*::'' +V-73377::*::'' +V-73391::*::'' +V-73393::*::'' +V-73395::*::'' +V-73397::*::'' +V-73399::*::'' diff --git a/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R9_Manual-xccdf.log b/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R9_Manual-xccdf.log index 43418fd95..dd14acdef 100644 --- a/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R9_Manual-xccdf.log +++ b/StigData/Archive/Windows.Server.2016/U_MS_Windows_Server_2016_DC_STIG_V1R9_Manual-xccdf.log @@ -12,3 +12,9 @@ V-73551::Value: 0x00000000 (0) (Security), 0x00000001 (1) (Basic)::Value: 0x0000 V-73711::Value: 0x00000002 (2) (Prompt for consent on the secure desktop)::Value: 1 or 2 V-73755::Passwords for application accounts with this user right must be protected as highly privileged accounts.::"" V-73375::*::'' +V-73377::*::'' +V-73391::*::'' +V-73393::*::'' +V-73395::*::'' +V-73397::*::'' +V-73399::*::'' diff --git a/StigData/Processed/WindowsServer-2016-DC-1.8.xml b/StigData/Processed/WindowsServer-2016-DC-1.8.xml index c85a05517..218da3654 100644 --- a/StigData/Processed/WindowsServer-2016-DC-1.8.xml +++ b/StigData/Processed/WindowsServer-2016-DC-1.8.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>This policy setting determines whether the Kerberos Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the target computer. The policy is enabled by default, which is the most secure setting for validating that access to target resources is not circumvented. @@ -2163,6 +2163,128 @@ BUILTIN\Administrators:(I)(F) (I) - permission inherited from parent container (F) - full access + + + <VulnDiscussion>When Active Directory objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. + +The Domain Controllers OU object requires special attention as the Domain Controllers are central to the configuration and management of the domain. Inappropriate access permissions defined for the Domain Controllers OU could allow an intruder or unauthorized personnel to make changes that could lead to the compromise of the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Review the permissions on the Domain Controllers OU. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Select "Advanced Features" in the "View" menu if not previously selected. + +Select the "Domain Controllers" OU (folder in folder icon). + +Right-click and select "Properties". + +Select the "Security" tab. + +If the permissions on the Domain Controllers OU do not restrict changes to System, Domain Admins, Enterprise Admins and Administrators, this is a finding. + +The default permissions listed below satisfy this requirement. + +Domains supporting Microsoft Exchange will have additional Exchange related permissions on the Domain Controllers OU. These may include some change related permissions and are not a finding. + +The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "View" or "Edit" button. + +Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. + +CREATOR OWNER - Special permissions + +SELF - Special permissions + +Authenticated Users - Read, Special permissions + +The special permissions for Authenticated Users are Read types. + +If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +SYSTEM - Full Control + +Domain Admins - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Enterprise Admins - Full Control + +Key Admins - Special permissions + +Enterprise Key Admins - Special permissions + +Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Pre-Windows 2000 Compatible Access - Special permissions + +The Special permissions for Pre-Windows 2000 Compatible Access are Read types. + +If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + + + <VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. + +For Active Directory, the OU objects require special attention. In a distributed administration model (i.e., help desk), OU objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for OU objects, it could allow an intruder to add or delete users in the OU. This could result in unauthorized access to data or a denial of service to authorized users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Review the permissions on domain-defined OUs. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +For each OU that is defined (folder in folder icon) excluding the Domain Controllers OU: + +Right-click the OU and select "Properties". + +Select the "Security" tab. + +If the permissions on the OU are not at least as restrictive as those below, this is a finding. + +The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "Edit" or "View" button. + +Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. + +CREATOR OWNER - Special permissions + +Self - Special permissions + +Authenticated Users - Read, Special permissions + +The Special permissions for Authenticated Users are Read type. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +SYSTEM - Full Control + +Domain Admins - Full Control + +Enterprise Admins - Full Control + +Key Admins - Special permissions + +Enterprise Key Admins - Special permissions + +Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Pre-Windows 2000 Compatible Access - Special permissions + +The Special permissions for Pre-Windows 2000 Compatible Access are for Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + +If an ISSO-approved distributed administration model (help desk or other user support staff) is implemented, permissions above Read may be allowed for groups documented by the ISSO. + +If any OU with improper permissions includes identification or authentication data (e.g., accounts, passwords, or password hash data) used by systems to determine access control, the severity is CAT I (e.g., OUs that include user accounts, including service/application accounts). + +If an OU with improper permissions does not include identification and authentication data used by systems to determine access control, the severity is CAT II (e.g., Workstation, Printer OUs). <VulnDiscussion>When directory service data files, especially for directories used for identification, authentication, or authorization, reside on the same logical partition as user-owned files, the directory service data may be more vulnerable to unauthorized access or other availability compromises. Directory service and user-owned data files sharing a partition may be configured with less restrictive permissions in order to allow access to the user data. @@ -2352,1906 +2474,1374 @@ Access - blank (Permissions: none selected; Properties: one instance - Write gPL Inherited from - Parent Object Applies to - Descendant Organization Unit Objects - - <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Determine if a process to back up log data to a different system or media than the system being audited has been implemented. - -If it has not, this is a finding. - - - <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Verify the audit records, at a minimum, are off-loaded for interconnected systems in real time and off-loaded for standalone systems weekly. + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. -If they are not, this is a finding. - - - <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. -Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False - Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates. - -Run "PowerShell" as an administrator. - -Execute the following command: - -Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter - -If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. - -If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. - -Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US -Issuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F -NotAfter: 9/6/2019 - -Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US -Issuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 -NotAfter: 1/22/2022 - -Alternately use the Certificates MMC snap-in: + This applies to domain controllers. It is NA for other systems. -Run "MMC". +Review the auditing configuration for the Domain object. -Select "File", "Add/Remove Snap-in". +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). -Select "Certificates", click "Add". +Ensure "Advanced Features" is selected in the "View" menu. -Select "Computer account", click "Next". +Select the domain being reviewed in the left pane. -Select "Local computer: (the computer this console is running on)", click "Finish". +Right-click the domain name and select "Properties". -Click "OK". +Select the "Security" tab. -Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". +Select the "Advanced" button and then the "Auditing" tab. -For each certificate with "DoD Root CA…" under "Issued To" and "DoD Interoperability Root CA…" under "Issued By": +If the audit settings on the Domain object are not at least as inclusive as those below, this is a finding. -Right-click on the certificate and select "Open". +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only -Select the "Details" Tab. +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. -Scroll to the bottom and select "Thumbprint". +Two instances with the following summary information will be listed. -If the certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - None +Applies to - Special -If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. +Type - Success +Principal - Domain Users +Access - All extended rights +Inherited from - None +Applies to - This object only -Issued To: DoD Root CA 2 -Issued By: DoD Interoperability Root CA 1 -Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F -Valid to: Friday, September 6, 2019 +Type - Success +Principal - Administrators +Access - All extended rights +Inherited from - None +Applies to - This object only -Issued To: DoD Root CA 3 -Issued By: DoD Interoperability Root CA 2 -Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 -Valid to: Saturday, January 22, 2022 +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner) - - <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. -Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Infrastructure object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False - Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate. - -Run "PowerShell" as an administrator. + This applies to domain controllers. It is NA for other systems. -Execute the following command: +Review the auditing configuration for Infrastructure object. -Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). -If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. +Ensure "Advanced Features" is selected in the "View" menu. -If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. +Select the domain being reviewed in the left pane. -Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US -Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E -NotAfter: 9/27/2019 +Right-click the "Infrastructure" object in the right pane and select "Properties". -Alternately use the Certificates MMC snap-in: +Select the "Security" tab. -Run "MMC". +Select the "Advanced" button and then the "Auditing" tab. -Select "File", "Add/Remove Snap-in". +If the audit settings on the Infrastructure object are not at least as inclusive as those below, this is a finding. -Select "Certificates", click "Add". - -Select "Computer account", click "Next". - -Select "Local computer: (the computer this console is running on)", click "Finish". - -Click "OK". - -Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". - -For each certificate with "US DoD CCEB Interoperability Root CA …" under "Issued By": - -Right-click on the certificate and select "Open". +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None -Select the "Details" Tab. +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. -Scroll to the bottom and select "Thumbprint". +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master) -If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding. +Two instances with the following summary information will be listed. +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. -If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain Controller OU object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. -Issued To: DoD Root CA 3 -Issuer by: US DoD CCEB Interoperability Root CA 2 -Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E -Valid: Friday, September 27, 2019 - - - <VulnDiscussion>Domain controllers are part of the chain of trust for PKI authentications. Without the appropriate certificate, the authenticity of the domain controller cannot be verified. Domain controllers must have a server certificate to establish authenticity as part of PKI authentications in the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False This applies to domain controllers. It is NA for other systems. -Run "MMC". +Review the auditing configuration for the Domain Controller OU object. -Select "Add/Remove Snap-in" from the "File" menu. +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). -Select "Certificates" in the left pane and click the "Add >" button. +Ensure "Advanced Features" is selected in the "View" menu. -Select "Computer Account" and click "Next". +Select the "Domain Controllers OU" under the domain being reviewed in the left pane. -Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish". +Right-click the "Domain Controllers OU" object and select "Properties". -Click "OK". +Select the "Security" tab. -Select and expand the Certificates (Local Computer) entry in the left pane. +Select the "Advanced" button and then the "Auditing" tab. -Select and expand the Personal entry in the left pane. +If the audit settings on the Domain Controllers OU object are not at least as inclusive as those below, this is a finding. -Select the Certificates entry in the left pane. +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object and all descendant objects -If no certificate for the domain controller exists in the right pane, this is a finding. +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: all create, delete and modify permissions) + +Type - Success +Principal - Everyone +Access - Write all properties +Inherited from - None +Applies to - This object and all descendant objects + +Two instances with the following summary information will be listed. + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objects - - <VulnDiscussion>A PKI implementation depends on the practices established by the Certificate Authority (CA) to ensure the implementation is secure. Without proper practices, the certificates issued by a CA have limited value in authentication functions. The use of multiple CAs from separate PKI implementations results in interoperability issues. If servers and clients do not have a common set of root CA certificates, they are not able to authenticate each other.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the AdminSDHolder object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False This applies to domain controllers. It is NA for other systems. -Run "MMC". - -Select "Add/Remove Snap-in" from the "File" menu. - -Select "Certificates" in the left pane and click the "Add >" button. - -Select "Computer Account" and click "Next". +Review the auditing configuration for the "AdminSDHolder" object. -Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish". +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). -Click "OK". +Ensure "Advanced Features" is selected in the "View" menu. -Select and expand the Certificates (Local Computer) entry in the left pane. +Select "System" under the domain being reviewed in the left pane. -Select and expand the Personal entry in the left pane. +Right-click the "AdminSDHolder" object in the right pane and select "Properties". -Select the Certificates entry in the left pane. +Select the "Security" tab. -In the right pane, examine the "Issued By" field for the certificate to determine the issuing CA. +Select the "Advanced" button and then the "Auditing" tab. -If the "Issued By" field of the PKI certificate being used by the domain controller does not indicate the issuing CA is part of the DoD PKI or an approved ECA, this is a finding. +If the audit settings on the "AdminSDHolder" object are not at least as inclusive as those below, this is a finding. -If the certificates in use are issued by a CA authorized by the Component's CIO, this is a CAT II finding. +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only -There are multiple sources from which lists of valid DoD CAs and approved ECAs can be obtained: +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. -The Global Directory Service (GDS) website provides an online source. The address for this site is https://crl.gds.disa.mil. +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Write all properties, Modify permissions, Modify owner) -DoD Public Key Enablement (PKE) Engineering Support maintains the InstallRoot utility to manage DoD supported root certificates on Windows computers, which includes a list of authorized CAs. The utility package can be downloaded from the PKI and PKE Tools page on IASE: +Two instances with the following summary information will be listed. -http://iase.disa.mil/pki-pke/function_pages/tools.html +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objects - - <VulnDiscussion>Smart cards such as the CAC support a two-factor authentication technique. This provides a higher level of trust in the asserted identity than use of the username and password for authentication. + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. -Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055, SRG-OS-000375-GPOS-00160</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the RID Manager$ object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False This applies to domain controllers. It is NA for other systems. -Open "PowerShell". +Review the auditing configuration for the "RID Manager$" object. -Enter the following: +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). -"Get-ADUser -Filter {(Enabled -eq $True) -and (SmartcardLogonRequired -eq $False)} | FT Name" -("DistinguishedName" may be substituted for "Name" for more detailed output.) +Ensure "Advanced Features" is selected in the "View" menu. -If any user accounts, including administrators, are listed, this is a finding. +Select "System" under the domain being reviewed in the left pane. -Alternately: +Right-click the "RID Manager$" object in the right pane and select "Properties". -To view sample accounts in "Active Directory Users and Computers" (available from various menus or run "dsa.msc"): +Select the "Security" tab. -Select the Organizational Unit (OU) where the user accounts are located. (By default, this is the Users node; however, accounts may be under other organization-defined OUs.) +Select the "Advanced" button and then the "Auditing" tab. -Right-click the sample user account and select "Properties". +If the audit settings on the "RID Manager$" object are not at least as inclusive as those below, this is a finding. -Select the "Account" tab. +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None -If any user accounts, including administrators, do not have "Smart card is required for interactive logon" checked in the "Account Options" area, this is a finding. +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None + (Access - Special = Write all properties, All extended rights, Change RID master) + +Two instances with the following summary information will be listed. + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) - - <VulnDiscussion></VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False - Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled. - -Run "System Information". + Determine if a process to back up log data to a different system or media than the system being audited has been implemented. -Under "System Summary", if "Secure Boot State" does not display "On", this is finding. +If it has not, this is a finding. - - <VulnDiscussion>UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in "Legacy BIOS" mode will not support these security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False - Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must run in "UEFI" mode. - -Verify the system firmware is configured to run in "UEFI" mode, not "Legacy BIOS". - -Run "System Information". + Verify the audit records, at a minimum, are off-loaded for interconnected systems in real time and off-loaded for standalone systems weekly. -Under "System Summary", if "BIOS Mode" does not display "UEFI", this is finding. +If they are not, this is a finding. - - <VulnDiscussion>The krbtgt account acts as a service account for the Kerberos Key Distribution Center (KDC) service. The account and password are created when a domain is created and the password is typically not changed. If the krbtgt account is compromised, attackers can create valid Kerberos Ticket Granting Tickets (TGT). + + <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. -The password must be changed twice to effectively remove the password history. Changing once, waiting for replication to complete and changing again reduces the risk of issues. Changing twice in rapid succession forces clients to re-authenticate (including application services) but is desired if a compromise is suspected.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False - This requirement is applicable to domain controllers; it is NA for other systems. + Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates. -Open "Windows PowerShell". +Run "PowerShell" as an administrator. -Enter "Get-ADUser krbtgt -Property PasswordLastSet". +Execute the following command: -If the "PasswordLastSet" date is more than 180 days old, this is a finding. - - - <VulnDiscussion>Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups. If the account or group objects are reanimated, there is a potential they may still have rights no longer intended. Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Review the effective User Rights setting in Local Group Policy Editor. +Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter -Run "gpedit.msc". +If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. +If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. -Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of "*S-1-…".) +Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F +NotAfter: 9/6/2019 -If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding. +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 +NotAfter: 1/22/2022 - - - - - - - - - - SYSTEM - False - This folder subfolders and files - FullControl - - - - - Administrators - False - This folder subfolders and files - FullControl - - - - - Users - False - This folder subfolders and files - ReadAndExecute - - - - - Users - False - This folder and subfolders - CreateDirectories,AppendData - - - - - Users - False - Subfolders only - CreateFiles,WriteData - - - - - CREATOR OWNER - False - Subfolders and files only - FullControl - - - <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. +Alternately use the Certificates MMC snap-in: -The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). +Run "MMC". -Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +Select "File", "Add/Remove Snap-in". + +Select "Certificates", click "Add". + +Select "Computer account", click "Next". + +Select "Local computer: (the computer this console is running on)", click "Finish". + +Click "OK". + +Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". + +For each certificate with "DoD Root CA…" under "Issued To" and "DoD Interoperability Root CA…" under "Issued By": + +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. + +Issued To: DoD Root CA 2 +Issued By: DoD Interoperability Root CA 1 +Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F +Valid to: Friday, September 6, 2019 + +Issued To: DoD Root CA 3 +Issued By: DoD Interoperability Root CA 2 +Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 +Valid to: Saturday, January 22, 2022 + + + <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. + +Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - True False False - %SystemDrive%\ - The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). + Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate. -Review the permissions for the system drive's root directory (usually C:\). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) +Run "PowerShell" as an administrator. -If permissions are not as restrictive as the default permissions listed below, this is a finding. +Execute the following command: -Viewing in File Explorer: +Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter -View the Properties of the system drive's root directory. +If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. -Select the "Security" tab, and the "Advanced" button. +If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. -Default permissions: -C:\ -Type - "Allow" for all -Inherited from - "None" for all +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E +NotAfter: 9/27/2019 -Principal - Access - Applies to +Alternately use the Certificates MMC snap-in: -SYSTEM - Full control - This folder, subfolders, and files -Administrators - Full control - This folder, subfolders, and files -Users - Read & execute - This folder, subfolders, and files -Users - Create folders/append data - This folder and subfolders -Users - Create files/write data - Subfolders only -CREATOR OWNER - Full Control - Subfolders and files only +Run "MMC". -Alternately, use icacls: +Select "File", "Add/Remove Snap-in". -Open "Command Prompt (Admin)". +Select "Certificates", click "Add". -Enter "icacls" followed by the directory: +Select "Computer account", click "Next". -"icacls c:\" +Select "Local computer: (the computer this console is running on)", click "Finish". -The following results should be displayed: +Click "OK". -c:\ -NT AUTHORITY\SYSTEM:(OI)(CI)(F) -BUILTIN\Administrators:(OI)(CI)(F) -BUILTIN\Users:(OI)(CI)(RX) -BUILTIN\Users:(CI)(AD) -BUILTIN\Users:(CI)(IO)(WD) -CREATOR OWNER:(OI)(CI)(IO)(F) -Successfully processed 1 files; Failed processing 0 files - - - - - - - TrustedInstaller - False - This folder and subfolders - FullControl - - - - - SYSTEM - False - This folder only - Modify - - - - - SYSTEM - False - Subfolders and files only - FullControl - - - - - Administrators - False - This folder only - Modify - - - - - Administrators - False - Subfolders and files only - FullControl - - - - - Users - False - This folder subfolders and files - ReadAndExecute - - - - - CREATOR OWNER - False - Subfolders and files only - FullControl - - - - - ALL APPLICATION PACKAGES - False - This folder subfolders and files - ReadAndExecute - - - - - ALL RESTRICTED APPLICATION PACKAGES - False - This folder subfolders and files - ReadAndExecute - - - <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. +Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". -The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). +For each certificate with "US DoD CCEB Interoperability Root CA …" under "Issued By": -Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. + +Issued To: DoD Root CA 3 +Issuer by: US DoD CCEB Interoperability Root CA 2 +Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E +Valid: Friday, September 27, 2019 + + + <VulnDiscussion>Domain controllers are part of the chain of trust for PKI authentications. Without the appropriate certificate, the authenticity of the domain controller cannot be verified. Domain controllers must have a server certificate to establish authenticity as part of PKI authentications in the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - True False False - %ProgramFiles(x86)% - The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). -Review the permissions for the program file directories (Program Files and Program Files [x86]). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. (Individual accounts must not be used to assign permissions.) -If permissions are not as restrictive as the default permissions listed below, this is a finding. -Viewing in File Explorer: -For each folder, view the Properties. -Select the "Security" tab, and the "Advanced" button. -Default permissions: -\Program Files (x86) -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -TrustedInstaller - Full control - This folder and subfolders -SYSTEM - Modify - This folder only -SYSTEM - Full control - Subfolders and files only -Administrators - Modify - This folder only -Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders and files -CREATOR OWNER - Full control - Subfolders and files only -ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files -ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files -Alternately, use icacls: -Open a Command prompt (admin). -Enter "icacls" followed by the directory: -'icacls "c:\program files"' -'icacls "c:\program files (x86)"' -The following results should be displayed for each when entered: -c:\program files (c:\program files (x86)) -NT SERVICE\TrustedInstaller:(F) -NT SERVICE\TrustedInstaller:(CI)(IO)(F) -NT AUTHORITY\SYSTEM:(M) -NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) -BUILTIN\Administrators:(M) -BUILTIN\Administrators:(OI)(CI)(IO)(F) -BUILTIN\Users:(RX) -BUILTIN\Users:(OI)(CI)(IO)(GR,GE) -CREATOR OWNER:(OI)(CI)(IO)(F) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -Successfully processed 1 files; Failed processing 0 files - - - - - - - - TrustedInstaller - False - This folder and subfolders - FullControl - - - - - SYSTEM - False - This folder only - Modify - - - - - SYSTEM - False - Subfolders and files only - FullControl - - - - - Administrators - False - This folder only - Modify - - - - - Administrators - False - Subfolders and files only - FullControl - - - - - Users - False - This folder subfolders and files - ReadAndExecute - - - - - CREATOR OWNER - False - Subfolders and files only - FullControl - - - - - ALL APPLICATION PACKAGES - False - This folder subfolders and files - ReadAndExecute - - - - - ALL RESTRICTED APPLICATION PACKAGES - False - This folder subfolders and files - ReadAndExecute - - - <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + This applies to domain controllers. It is NA for other systems. -The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). +Run "MMC". -Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +Select "Add/Remove Snap-in" from the "File" menu. + +Select "Certificates" in the left pane and click the "Add >" button. + +Select "Computer Account" and click "Next". + +Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish". + +Click "OK". + +Select and expand the Certificates (Local Computer) entry in the left pane. + +Select and expand the Personal entry in the left pane. + +Select the Certificates entry in the left pane. + +If no certificate for the domain controller exists in the right pane, this is a finding. + + + <VulnDiscussion>A PKI implementation depends on the practices established by the Certificate Authority (CA) to ensure the implementation is secure. Without proper practices, the certificates issued by a CA have limited value in authentication functions. The use of multiple CAs from separate PKI implementations results in interoperability issues. If servers and clients do not have a common set of root CA certificates, they are not able to authenticate each other.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - True False False - %ProgramFiles% - The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). -Review the permissions for the program file directories (Program Files and Program Files [x86]). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. (Individual accounts must not be used to assign permissions.) -If permissions are not as restrictive as the default permissions listed below, this is a finding. -Viewing in File Explorer: -For each folder, view the Properties. -Select the "Security" tab, and the "Advanced" button. -Default permissions: -\Program Files -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -TrustedInstaller - Full control - This folder and subfolders -SYSTEM - Modify - This folder only -SYSTEM - Full control - Subfolders and files only -Administrators - Modify - This folder only -Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders and files -CREATOR OWNER - Full control - Subfolders and files only -ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files -ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files -Alternately, use icacls: -Open a Command prompt (admin). -Enter "icacls" followed by the directory: -'icacls "c:\program files"' -'icacls "c:\program files (x86)"' -The following results should be displayed for each when entered: -c:\program files (c:\program files (x86)) -NT SERVICE\TrustedInstaller:(F) -NT SERVICE\TrustedInstaller:(CI)(IO)(F) -NT AUTHORITY\SYSTEM:(M) -NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) -BUILTIN\Administrators:(M) -BUILTIN\Administrators:(OI)(CI)(IO)(F) -BUILTIN\Users:(RX) -BUILTIN\Users:(OI)(CI)(IO)(GR,GE) -CREATOR OWNER:(OI)(CI)(IO)(F) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -Successfully processed 1 files; Failed processing 0 files - - - - - - - - TrustedInstaller - False - This folder and subfolders - FullControl - - - - - SYSTEM - False - This folder only - Modify - - - - - SYSTEM - False - Subfolders and files only - FullControl - - - - - Administrators - False - This folder only - Modify - - - - - Administrators - False - Subfolders and files only - FullControl - - - - - Users - False - This folder subfolders and files - ReadAndExecute - - - - - CREATOR OWNER - False - Subfolders and files only - FullControl - - - - - ALL APPLICATION PACKAGES - False - This folder subfolders and files - ReadAndExecute - - - - - ALL RESTRICTED APPLICATION PACKAGES - False - This folder subfolders and files - ReadAndExecute - - - <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + This applies to domain controllers. It is NA for other systems. + +Run "MMC". + +Select "Add/Remove Snap-in" from the "File" menu. + +Select "Certificates" in the left pane and click the "Add >" button. + +Select "Computer Account" and click "Next". + +Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish". + +Click "OK". + +Select and expand the Certificates (Local Computer) entry in the left pane. + +Select and expand the Personal entry in the left pane. + +Select the Certificates entry in the left pane. + +In the right pane, examine the "Issued By" field for the certificate to determine the issuing CA. + +If the "Issued By" field of the PKI certificate being used by the domain controller does not indicate the issuing CA is part of the DoD PKI or an approved ECA, this is a finding. -The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). +If the certificates in use are issued by a CA authorized by the Component's CIO, this is a CAT II finding. -Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - %windir% - The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). +There are multiple sources from which lists of valid DoD CAs and approved ECAs can be obtained: -Review the permissions for the Windows installation directory (usually C:\Windows). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. (Individual accounts must not be used to assign permissions.) +The Global Directory Service (GDS) website provides an online source. The address for this site is https://crl.gds.disa.mil. -If permissions are not as restrictive as the default permissions listed below, this is a finding. +DoD Public Key Enablement (PKE) Engineering Support maintains the InstallRoot utility to manage DoD supported root certificates on Windows computers, which includes a list of authorized CAs. The utility package can be downloaded from the PKI and PKE Tools page on IASE: -Viewing in File Explorer: +http://iase.disa.mil/pki-pke/function_pages/tools.html + + + <VulnDiscussion>Smart cards such as the CAC support a two-factor authentication technique. This provides a higher level of trust in the asserted identity than use of the username and password for authentication. -For each folder, view the Properties. +Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055, SRG-OS-000375-GPOS-00160</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. -Select the "Security" tab and the "Advanced" button. +Open "PowerShell". -Default permissions: -\Windows -Type - "Allow" for all -Inherited from - "None" for all +Enter the following: -Principal - Access - Applies to +"Get-ADUser -Filter {(Enabled -eq $True) -and (SmartcardLogonRequired -eq $False)} | FT Name" +("DistinguishedName" may be substituted for "Name" for more detailed output.) -TrustedInstaller - Full control - This folder and subfolders -SYSTEM - Modify - This folder only -SYSTEM - Full control - Subfolders and files only -Administrators - Modify - This folder only -Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders, and files -CREATOR OWNER - Full control - Subfolders and files only -ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files -ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +If any user accounts, including administrators, are listed, this is a finding. -Alternately, use icacls: +Alternately: -Open a Command prompt (admin). +To view sample accounts in "Active Directory Users and Computers" (available from various menus or run "dsa.msc"): -Enter "icacls" followed by the directory: +Select the Organizational Unit (OU) where the user accounts are located. (By default, this is the Users node; however, accounts may be under other organization-defined OUs.) -"icacls c:\windows" +Right-click the sample user account and select "Properties". -The following results should be displayed for each when entered: +Select the "Account" tab. -c:\windows -NT SERVICE\TrustedInstaller:(F) -NT SERVICE\TrustedInstaller:(CI)(IO)(F) -NT AUTHORITY\SYSTEM:(M) -NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) -BUILTIN\Administrators:(M) -BUILTIN\Administrators:(OI)(CI)(IO)(F) -BUILTIN\Users:(RX) -BUILTIN\Users:(OI)(CI)(IO)(GR,GE) -CREATOR OWNER:(OI)(CI)(IO)(F) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -Successfully processed 1 files; Failed processing 0 files +If any user accounts, including administrators, do not have "Smart card is required for interactive logon" checked in the "Account Options" area, this is a finding. - - - - - - SYSTEM - False - This Key and Subkeys - FullControl - - - <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + <VulnDiscussion></VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - True False False - HKLM:\SECURITY - Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. -If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. -If permissions are not as restrictive as the default permissions listed below, this is a finding. -Run "Regedit". -Right-click on the registry areas noted below. -Select "Permissions..." and the "Advanced" button. -HKEY_LOCAL_MACHINE\SECURITY -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -SYSTEM - Full Control - This key and subkeys -Administrators - Special - This key and subkeys -Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. -If the defaults have not been changed, these are not a finding. - + Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled. + +Run "System Information". + +Under "System Summary", if "Secure Boot State" does not display "On", this is finding. - - - - - - Users - False - This Key and Subkeys - ReadKey - - - - - Administrators - False - This Key and Subkeys - FullControl - - - - - SYSTEM - False - This Key and Subkeys - FullControl - - - - - CREATOR OWNER - False - This Key and Subkeys - FullControl - - - - - ALL APPLICATION PACKAGES - False - This Key and Subkeys - ReadKey - - - <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + <VulnDiscussion>UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows 10, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in "Legacy BIOS" mode will not support these security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - True False False - HKLM:\SOFTWARE - Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. -If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. -If permissions are not as restrictive as the default permissions listed below, this is a finding. -Run "Regedit". -Right-click on the registry areas noted below. -Select "Permissions..." and the "Advanced" button. -HKEY_LOCAL_MACHINE\SOFTWARE -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -Users - Read - This key and subkeys -Administrators - Full Control - This key and subkeys -SYSTEM - Full Control - This key and subkeys -CREATOR OWNER - Full Control - This key and subkeys -ALL APPLICATION PACKAGES - Read - This key and subkeys -Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. -If the defaults have not been changed, these are not a finding. - + Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must run in "UEFI" mode. + +Verify the system firmware is configured to run in "UEFI" mode, not "Legacy BIOS". + +Run "System Information". + +Under "System Summary", if "BIOS Mode" does not display "UEFI", this is finding. - - - - - - Users - False - This Key and Subkeys - ReadKey - - - - - Administrators - False - This Key and Subkeys - FullControl - - - - - SYSTEM - False - This Key and Subkeys - FullControl - - - - - CREATOR OWNER - False - Subkeys Only - FullControl - - - - - ALL APPLICATION PACKAGES - False - This Key and Subkeys - ReadKey - - - <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + <VulnDiscussion>The krbtgt account acts as a service account for the Kerberos Key Distribution Center (KDC) service. The account and password are created when a domain is created and the password is typically not changed. If the krbtgt account is compromised, attackers can create valid Kerberos Ticket Granting Tickets (TGT). + +The password must be changed twice to effectively remove the password history. Changing once, waiting for replication to complete and changing again reduces the risk of issues. Changing twice in rapid succession forces clients to re-authenticate (including application services) but is desired if a compromise is suspected.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - True False False - HKLM:\SYSTEM - Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. -If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. -If permissions are not as restrictive as the default permissions listed below, this is a finding. -Run "Regedit". -Right-click on the registry areas noted below. -Select "Permissions..." and the "Advanced" button. -HKEY_LOCAL_MACHINE\SYSTEM -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -Users - Read - This key and subkeys -Administrators - Full Control - This key and subkeys -SYSTEM - Full Control - This key and subkeys -CREATOR OWNER - Full Control - Subkeys only -ALL APPLICATION PACKAGES - Read - This key and subkeys -Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. -If the defaults have not been changed, these are not a finding. + This requirement is applicable to domain controllers; it is NA for other systems. + +Open "Windows PowerShell". + +Enter "Get-ADUser krbtgt -Property PasswordLastSet". + +If the "PasswordLastSet" date is more than 180 days old, this is a finding. + + + <VulnDiscussion>Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups. If the account or group objects are reanimated, there is a potential they may still have rights no longer intended. Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the effective User Rights setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of "*S-1-…".) + +If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding. + - + + + - Authenticated Users + SYSTEM False This folder subfolders and files - ReadAndExecute + FullControl - Server Operators + Administrators False This folder subfolders and files - ReadAndExecute + FullControl - Administrators + Users False - This folder only - AppendData,ChangePermissions,CreateDirectories,CreateFiles,Delete,DeleteSubdirectoriesAndFiles,ExecuteFile,ListDirectory,Modify,Read,ReadAndExecute,ReadAttributes,ReadData,ReadExtendedAttributes,ReadPermissions,Synchronize,TakeOwnership,Traverse,Write,WriteAttributes,WriteData,WriteExtendedAttributes + This folder subfolders and files + ReadAndExecute - CREATOR OWNER + Users False - Subfolders and files only - FullControl + This folder and subfolders + CreateDirectories,AppendData - Administrators + Users False - Subfolders and files only - FullControl + Subfolders only + CreateFiles,WriteData - SYSTEM + CREATOR OWNER False - This folder subfolders and files + Subfolders and files only FullControl - <VulnDiscussion>Improper access permissions for directory data files could allow unauthorized users to read, modify, or delete directory data. + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. -The SYSVOL directory contains public files (to the domain) such as policies and logon scripts. Data in shared subdirectories are replicated to all domain controllers in a domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> True False False - %windir%\sysvol - This applies to domain controllers. It is NA for other systems. - -Open a command prompt. - -Run "net share". - -Make note of the directory location of the SYSVOL share. - -By default, this will be \Windows\SYSVOL\sysvol. For this requirement, permissions will be verified at the first SYSVOL directory level. - -If any standard user accounts or groups have greater than "Read & execute" permissions, this is a finding. - -The default permissions noted below meet this requirement. + %SystemDrive%\ + The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). -Open "Command Prompt". +Review the permissions for the system drive's root directory (usually C:\). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) -Run "icacls c:\Windows\SYSVOL". +If permissions are not as restrictive as the default permissions listed below, this is a finding. -The following results should be displayed: +Viewing in File Explorer: -NT AUTHORITY\Authenticated Users:(RX) -NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(GR,GE) -BUILTIN\Server Operators:(RX) -BUILTIN\Server Operators:(OI)(CI)(IO)(GR,GE) -BUILTIN\Administrators:(M,WDAC,WO) -BUILTIN\Administrators:(OI)(CI)(IO)(F) -NT AUTHORITY\SYSTEM:(F) -NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) -BUILTIN\Administrators:(M,WDAC,WO) -CREATOR OWNER:(OI)(CI)(IO)(F) +View the Properties of the system drive's root directory. -(RX) - Read & execute +Select the "Security" tab, and the "Advanced" button. -Run "icacls /help" to view definitions of other permission codes. +Default permissions: +C:\ +Type - "Allow" for all +Inherited from - "None" for all -Alternately, open "File Explorer". +Principal - Access - Applies to -Navigate to \Windows\SYSVOL (or the directory noted previously if different). +SYSTEM - Full control - This folder, subfolders, and files +Administrators - Full control - This folder, subfolders, and files +Users - Read & execute - This folder, subfolders, and files +Users - Create folders/append data - This folder and subfolders +Users - Create files/write data - Subfolders only +CREATOR OWNER - Full Control - Subfolders and files only -Right-click the directory and select properties. +Alternately, use icacls: -Select the "Security" tab and click "Advanced". +Open "Command Prompt (Admin)". -Default permissions: +Enter "icacls" followed by the directory: -C:\Windows\SYSVOL -Type - "Allow" for all -Inherited from - "None" for all +"icacls c:\" -Principal - Access - Applies to +The following results should be displayed: -Authenticated Users - Read & execute- This folder, subfolder, and files -Server Operators - Read & execute- This folder, subfolder, and files -Administrators - Special - This folder only (Special = Basic Permissions: all selected except Full control) -CREATOR OWNER - Full control - Subfolders and files only -Administrators - Full control - Subfolders and files only -SYSTEM - Full control - This folder, subfolders, and files +c:\ +NT AUTHORITY\SYSTEM:(OI)(CI)(F) +BUILTIN\Administrators:(OI)(CI)(F) +BUILTIN\Users:(OI)(CI)(RX) +BUILTIN\Users:(CI)(AD) +BUILTIN\Users:(CI)(IO)(WD) +CREATOR OWNER:(OI)(CI)(IO)(F) +Successfully processed 1 files; Failed processing 0 files - + - CREATOR OWNER - False - - - - - - - - - SELF - False - - - - - - - - - Authenticated Users + TrustedInstaller False - - - - + This folder and subfolders + FullControl SYSTEM False - - - - + This folder only + Modify - Domain Admins + SYSTEM False - - - - + Subfolders and files only + FullControl - Enterprise Admins + Administrators False - - - - + This folder only + Modify - Key Admins + Administrators False - - - - + Subfolders and files only + FullControl - Enterprise Key Admins + Users False - - - - + This folder subfolders and files + ReadAndExecute - Administrators + CREATOR OWNER False - - - - + Subfolders and files only + FullControl - Pre-Windows 2000 Compatible Access + ALL APPLICATION PACKAGES False - - - - + This folder subfolders and files + ReadAndExecute - ENTERPRISE DOMAIN CONTROLLERS + ALL RESTRICTED APPLICATION PACKAGES False - - - - + This folder subfolders and files + ReadAndExecute - <VulnDiscussion>When Active Directory objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. -The Domain Controllers OU object requires special attention as the Domain Controllers are central to the configuration and management of the domain. Inappropriate access permissions defined for the Domain Controllers OU could allow an intruder or unauthorized personnel to make changes that could lead to the compromise of the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> True False False - - This applies to domain controllers. It is NA for other systems. - -Review the permissions on the Domain Controllers OU. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Select "Advanced Features" in the "View" menu if not previously selected. - -Select the "Domain Controllers" OU (folder in folder icon). - -Right-click and select "Properties". - -Select the "Security" tab. - -If the permissions on the Domain Controllers OU do not restrict changes to System, Domain Admins, Enterprise Admins and Administrators, this is a finding. - -The default permissions listed below satisfy this requirement. - -Domains supporting Microsoft Exchange will have additional Exchange related permissions on the Domain Controllers OU. These may include some change related permissions and are not a finding. - -The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "View" or "Edit" button. - -Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. - -CREATOR OWNER - Special permissions - -SELF - Special permissions - -Authenticated Users - Read, Special permissions - -The special permissions for Authenticated Users are Read types. - -If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -SYSTEM - Full Control - -Domain Admins - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Enterprise Admins - Full Control - -Key Admins - Special permissions - -Enterprise Key Admins - Special permissions - -Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Pre-Windows 2000 Compatible Access - Special permissions - -The Special permissions for Pre-Windows 2000 Compatible Access are Read types. - -If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + %ProgramFiles(x86)% + The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). +Review the permissions for the program file directories (Program Files and Program Files [x86]). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. (Individual accounts must not be used to assign permissions.) +If permissions are not as restrictive as the default permissions listed below, this is a finding. +Viewing in File Explorer: +For each folder, view the Properties. +Select the "Security" tab, and the "Advanced" button. +Default permissions: +\Program Files (x86) +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +Alternately, use icacls: +Open a Command prompt (admin). +Enter "icacls" followed by the directory: +'icacls "c:\program files"' +'icacls "c:\program files (x86)"' +The following results should be displayed for each when entered: +c:\program files (c:\program files (x86)) +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 files + - + - CREATOR OWNER - False - - - - - - - - - Self - False - - - - - - - - - Authenticated Users + TrustedInstaller False - - - - + This folder and subfolders + FullControl SYSTEM False - - - - + This folder only + Modify - Domain Admins + SYSTEM False - - - - + Subfolders and files only + FullControl - Enterprise Admins + Administrators False - - - - + This folder only + Modify - Key Admins + Administrators False - - - - + Subfolders and files only + FullControl - Enterprise Key Admins + Users False - - - - + This folder subfolders and files + ReadAndExecute - Administrators + CREATOR OWNER False - - - - + Subfolders and files only + FullControl - Pre-Windows 2000 Compatible Access + ALL APPLICATION PACKAGES False - - - - + This folder subfolders and files + ReadAndExecute - ENTERPRISE DOMAIN CONTROLLERS + ALL RESTRICTED APPLICATION PACKAGES False - - - - + This folder subfolders and files + ReadAndExecute - <VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. -For Active Directory, the OU objects require special attention. In a distributed administration model (i.e., help desk), OU objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for OU objects, it could allow an intruder to add or delete users in the OU. This could result in unauthorized access to data or a denial of service to authorized users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-73375 +The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + True False False - - This applies to domain controllers. It is NA for other systems. - -Review the permissions on domain-defined OUs. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -For each OU that is defined (folder in folder icon) excluding the Domain Controllers OU: - -Right-click the OU and select "Properties". - -Select the "Security" tab. - -If the permissions on the OU are not at least as restrictive as those below, this is a finding. - -The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "Edit" or "View" button. - -Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. - -CREATOR OWNER - Special permissions - -Self - Special permissions - -Authenticated Users - Read, Special permissions - -The Special permissions for Authenticated Users are Read type. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -SYSTEM - Full Control - -Domain Admins - Full Control - -Enterprise Admins - Full Control - -Key Admins - Special permissions - -Enterprise Key Admins - Special permissions - -Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Pre-Windows 2000 Compatible Access - Special permissions - -The Special permissions for Pre-Windows 2000 Compatible Access are for Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions - -If an ISSO-approved distributed administration model (help desk or other user support staff) is implemented, permissions above Read may be allowed for groups documented by the ISSO. - -If any OU with improper permissions includes identification or authentication data (e.g., accounts, passwords, or password hash data) used by systems to determine access control, the severity is CAT I (e.g., OUs that include user accounts, including service/application accounts). - -If an OU with improper permissions does not include identification and authentication data used by systems to determine access control, the severity is CAT II (e.g., Workstation, Printer OUs). + %ProgramFiles% + The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). +Review the permissions for the program file directories (Program Files and Program Files [x86]). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. (Individual accounts must not be used to assign permissions.) +If permissions are not as restrictive as the default permissions listed below, this is a finding. +Viewing in File Explorer: +For each folder, view the Properties. +Select the "Security" tab, and the "Advanced" button. +Default permissions: +\Program Files +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +Alternately, use icacls: +Open a Command prompt (admin). +Enter "icacls" followed by the directory: +'icacls "c:\program files"' +'icacls "c:\program files (x86)"' +The following results should be displayed for each when entered: +c:\program files (c:\program files (x86)) +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 files + - + - Fail - Everyone + + + TrustedInstaller False - - - - + This folder and subfolders + FullControl - Success - Everyone + + + SYSTEM False - - - - + This folder only + Modify - Success - Domain Users + + + SYSTEM False - - - - + Subfolders and files only + FullControl + + + + + Administrators + False + This folder only + Modify - Success + + Administrators False - - - - + Subfolders and files only + FullControl + + + + + Users + False + This folder subfolders and files + ReadAndExecute + + + + + CREATOR OWNER + False + Subfolders and files only + FullControl + + + + + ALL APPLICATION PACKAGES + False + This folder subfolders and files + ReadAndExecute - Success - Everyone + + + ALL RESTRICTED APPLICATION PACKAGES False - - - - + This folder subfolders and files + ReadAndExecute - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. +The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-73375 +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + True False False - - This applies to domain controllers. It is NA for other systems. - -Review the auditing configuration for the Domain object. + %windir% + The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). +Review the permissions for the Windows installation directory (usually C:\Windows). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. (Individual accounts must not be used to assign permissions.) -Ensure "Advanced Features" is selected in the "View" menu. +If permissions are not as restrictive as the default permissions listed below, this is a finding. -Select the domain being reviewed in the left pane. +Viewing in File Explorer: -Right-click the domain name and select "Properties". +For each folder, view the Properties. -Select the "Security" tab. +Select the "Security" tab and the "Advanced" button. -Select the "Advanced" button and then the "Auditing" tab. +Default permissions: +\Windows +Type - "Allow" for all +Inherited from - "None" for all -If the audit settings on the Domain object are not at least as inclusive as those below, this is a finding. +Principal - Access - Applies to -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object only +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders, and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. +Alternately, use icacls: -Two instances with the following summary information will be listed. +Open a Command prompt (admin). -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - None -Applies to - Special +Enter "icacls" followed by the directory: -Type - Success -Principal - Domain Users -Access - All extended rights -Inherited from - None -Applies to - This object only +"icacls c:\windows" -Type - Success -Principal - Administrators -Access - All extended rights -Inherited from - None -Applies to - This object only +The following results should be displayed for each when entered: -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner) +c:\windows +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 files - + - Fail - Everyone + + + SYSTEM False - - - - + This Key and Subkeys + FullControl + + + <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + HKLM:\SECURITY + Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. +If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. +If permissions are not as restrictive as the default permissions listed below, this is a finding. +Run "Regedit". +Right-click on the registry areas noted below. +Select "Permissions..." and the "Advanced" button. +HKEY_LOCAL_MACHINE\SECURITY +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +SYSTEM - Full Control - This key and subkeys +Administrators - Special - This key and subkeys +Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. +If the defaults have not been changed, these are not a finding. + + + + + + + + Users + False + This Key and Subkeys + ReadKey - Success - Everyone + + + Administrators False - - - - + This Key and Subkeys + FullControl - Success - Everyone + + + SYSTEM False - - - - + This Key and Subkeys + FullControl + + + + + CREATOR OWNER + False + This Key and Subkeys + FullControl + + + + + ALL APPLICATION PACKAGES + False + This Key and Subkeys + ReadKey - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Infrastructure object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-73375 + <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + True False False - - This applies to domain controllers. It is NA for other systems. - -Review the auditing configuration for Infrastructure object. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -Select the domain being reviewed in the left pane. - -Right-click the "Infrastructure" object in the right pane and select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button and then the "Auditing" tab. - -If the audit settings on the Infrastructure object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master) - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) + HKLM:\SOFTWARE + Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. +If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. +If permissions are not as restrictive as the default permissions listed below, this is a finding. +Run "Regedit". +Right-click on the registry areas noted below. +Select "Permissions..." and the "Advanced" button. +HKEY_LOCAL_MACHINE\SOFTWARE +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +Users - Read - This key and subkeys +Administrators - Full Control - This key and subkeys +SYSTEM - Full Control - This key and subkeys +CREATOR OWNER - Full Control - This key and subkeys +ALL APPLICATION PACKAGES - Read - This key and subkeys +Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. +If the defaults have not been changed, these are not a finding. + - + - Fail - Everyone + + + Users False - - - - + This Key and Subkeys + ReadKey - Success - Everyone + + + Administrators False - - - - + This Key and Subkeys + FullControl + + + + + SYSTEM + False + This Key and Subkeys + FullControl - Success - Everyone + + + CREATOR OWNER False - - - - + Subkeys Only + FullControl - Success - Everyone + + + ALL APPLICATION PACKAGES False - - - - + This Key and Subkeys + ReadKey - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain Controller OU object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-73375 + <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + True False False - - This applies to domain controllers. It is NA for other systems. - -Review the auditing configuration for the Domain Controller OU object. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -Select the "Domain Controllers OU" under the domain being reviewed in the left pane. - -Right-click the "Domain Controllers OU" object and select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button and then the "Auditing" tab. - -If the audit settings on the Domain Controllers OU object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object and all descendant objects - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Permissions: all create, delete and modify permissions) - -Type - Success -Principal - Everyone -Access - Write all properties -Inherited from - None -Applies to - This object and all descendant objects - -Two instances with the following summary information will be listed. - -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) -Applies to - Descendant Organizational Unit objects + HKLM:\SYSTEM + Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. +If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. +If permissions are not as restrictive as the default permissions listed below, this is a finding. +Run "Regedit". +Right-click on the registry areas noted below. +Select "Permissions..." and the "Advanced" button. +HKEY_LOCAL_MACHINE\SYSTEM +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +Users - Read - This key and subkeys +Administrators - Full Control - This key and subkeys +SYSTEM - Full Control - This key and subkeys +CREATOR OWNER - Full Control - Subkeys only +ALL APPLICATION PACKAGES - Read - This key and subkeys +Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. +If the defaults have not been changed, these are not a finding. + - + - Fail - Everyone + + + Authenticated Users False - - - - + This folder subfolders and files + ReadAndExecute - Success - Everyone + + + Server Operators False - - - - + This folder subfolders and files + ReadAndExecute - Success - Everyone + + + Administrators False - - - - + This folder only + AppendData,ChangePermissions,CreateDirectories,CreateFiles,Delete,DeleteSubdirectoriesAndFiles,ExecuteFile,ListDirectory,Modify,Read,ReadAndExecute,ReadAttributes,ReadData,ReadExtendedAttributes,ReadPermissions,Synchronize,TakeOwnership,Traverse,Write,WriteAttributes,WriteData,WriteExtendedAttributes - - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the AdminSDHolder object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-73375 - True - False - False - - - This applies to domain controllers. It is NA for other systems. - -Review the auditing configuration for the "AdminSDHolder" object. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -Select "System" under the domain being reviewed in the left pane. - -Right-click the "AdminSDHolder" object in the right pane and select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button and then the "Auditing" tab. - -If the audit settings on the "AdminSDHolder" object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object only - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Write all properties, Modify permissions, Modify owner) - -Two instances with the following summary information will be listed. - -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) -Applies to - Descendant Organizational Unit objects - - - - Fail - Everyone + + + CREATOR OWNER False - - - - + Subfolders and files only + FullControl - Success - Everyone + + + Administrators False - - - - + Subfolders and files only + FullControl - Success - Everyone + + + SYSTEM False - - - - + This folder subfolders and files + FullControl - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the RID Manager$ object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + <VulnDiscussion>Improper access permissions for directory data files could allow unauthorized users to read, modify, or delete directory data. -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-73375 +The SYSVOL directory contains public files (to the domain) such as policies and logon scripts. Data in shared subdirectories are replicated to all domain controllers in a domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + True False False - + %windir%\sysvol This applies to domain controllers. It is NA for other systems. -Review the auditing configuration for the "RID Manager$" object. +Open a command prompt. -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). +Run "net share". -Ensure "Advanced Features" is selected in the "View" menu. +Make note of the directory location of the SYSVOL share. -Select "System" under the domain being reviewed in the left pane. +By default, this will be \Windows\SYSVOL\sysvol. For this requirement, permissions will be verified at the first SYSVOL directory level. -Right-click the "RID Manager$" object in the right pane and select "Properties". +If any standard user accounts or groups have greater than "Read & execute" permissions, this is a finding. -Select the "Security" tab. +The default permissions noted below meet this requirement. -Select the "Advanced" button and then the "Auditing" tab. +Open "Command Prompt". -If the audit settings on the "RID Manager$" object are not at least as inclusive as those below, this is a finding. +Run "icacls c:\Windows\SYSVOL". -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None +The following results should be displayed: -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. +NT AUTHORITY\Authenticated Users:(RX) +NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(GR,GE) +BUILTIN\Server Operators:(RX) +BUILTIN\Server Operators:(OI)(CI)(IO)(GR,GE) +BUILTIN\Administrators:(M,WDAC,WO) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(F) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M,WDAC,WO) +CREATOR OWNER:(OI)(CI)(IO)(F) -Type - Success -Principal - Everyone -Access - Special -Inherited from - None - (Access - Special = Write all properties, All extended rights, Change RID master) +(RX) - Read & execute -Two instances with the following summary information will be listed. +Run "icacls /help" to view definitions of other permission codes. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) +Alternately, open "File Explorer". + +Navigate to \Windows\SYSVOL (or the directory noted previously if different). + +Right-click the directory and select properties. + +Select the "Security" tab and click "Advanced". + +Default permissions: + +C:\Windows\SYSVOL +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +Authenticated Users - Read & execute- This folder, subfolder, and files +Server Operators - Read & execute- This folder, subfolder, and files +Administrators - Special - This folder only (Special = Basic Permissions: all selected except Full control) +CREATOR OWNER - Full control - Subfolders and files only +Administrators - Full control - Subfolders and files only +SYSTEM - Full control - This folder, subfolders, and files diff --git a/StigData/Processed/WindowsServer-2016-DC-1.9.org.default.xml b/StigData/Processed/WindowsServer-2016-DC-1.9.org.default.xml index 2594580cf..f5e3cdbb7 100644 --- a/StigData/Processed/WindowsServer-2016-DC-1.9.org.default.xml +++ b/StigData/Processed/WindowsServer-2016-DC-1.9.org.default.xml @@ -16,8 +16,6 @@ - - diff --git a/StigData/Processed/WindowsServer-2016-DC-1.9.xml b/StigData/Processed/WindowsServer-2016-DC-1.9.xml index 0b5f088a4..1150e18fc 100644 --- a/StigData/Processed/WindowsServer-2016-DC-1.9.xml +++ b/StigData/Processed/WindowsServer-2016-DC-1.9.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>This policy setting determines whether the Kerberos Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the target computer. The policy is enabled by default, which is the most secure setting for validating that access to target resources is not circumvented. @@ -2225,6 +2225,66 @@ The Special permissions for Pre-Windows 2000 Compatible Access are Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + + + <VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. + +For Active Directory, the OU objects require special attention. In a distributed administration model (i.e., help desk), OU objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for OU objects, it could allow an intruder to add or delete users in the OU. This could result in unauthorized access to data or a denial of service to authorized users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Review the permissions on domain-defined OUs. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +For each OU that is defined (folder in folder icon) excluding the Domain Controllers OU: + +Right-click the OU and select "Properties". + +Select the "Security" tab. + +If the permissions on the OU are not at least as restrictive as those below, this is a finding. + +The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "Edit" or "View" button. + +Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. + +CREATOR OWNER - Special permissions + +Self - Special permissions + +Authenticated Users - Read, Special permissions + +The Special permissions for Authenticated Users are Read type. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +SYSTEM - Full Control + +Domain Admins - Full Control + +Enterprise Admins - Full Control + +Key Admins - Special permissions + +Enterprise Key Admins - Special permissions + +Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Pre-Windows 2000 Compatible Access - Special permissions + +The Special permissions for Pre-Windows 2000 Compatible Access are for Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + +If an ISSO-approved distributed administration model (help desk or other user support staff) is implemented, permissions above Read may be allowed for groups documented by the ISSO. + +If any OU with improper permissions includes identification or authentication data (e.g., accounts, passwords, or password hash data) used by systems to determine access control, the severity is CAT I (e.g., OUs that include user accounts, including service/application accounts). + +If an OU with improper permissions does not include identification and authentication data used by systems to determine access control, the severity is CAT II (e.g., Workstation, Printer OUs). <VulnDiscussion>When directory service data files, especially for directories used for identification, authentication, or authorization, reside on the same logical partition as user-owned files, the directory service data may be more vulnerable to unauthorized access or other availability compromises. Directory service and user-owned data files sharing a partition may be configured with less restrictive permissions in order to allow access to the user data. @@ -2414,573 +2474,587 @@ Access - blank (Permissions: none selected; Properties: one instance - Write gPL Inherited from - Parent Object Applies to - Descendant Organization Unit Objects - - <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Determine if a process to back up log data to a different system or media than the system being audited has been implemented. - -If it has not, this is a finding. - - - <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Verify the audit records, at a minimum, are off-loaded for interconnected systems in real time and off-loaded for standalone systems weekly. + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. -If they are not, this is a finding. - - - <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. -Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False - Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates. - -Run "PowerShell" as an administrator. - -Execute the following command: - -Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter - -If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. - -If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. - -Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US -Issuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F -NotAfter: 9/6/2019 - -Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US -Issuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 -NotAfter: 1/22/2022 - -Alternately use the Certificates MMC snap-in: + This applies to domain controllers. It is NA for other systems. -Run "MMC". +Review the auditing configuration for the Domain object. -Select "File", "Add/Remove Snap-in". +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). -Select "Certificates", click "Add". +Ensure "Advanced Features" is selected in the "View" menu. -Select "Computer account", click "Next". +Select the domain being reviewed in the left pane. -Select "Local computer: (the computer this console is running on)", click "Finish". +Right-click the domain name and select "Properties". -Click "OK". +Select the "Security" tab. -Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". +Select the "Advanced" button and then the "Auditing" tab. -For each certificate with "DoD Root CA…" under "Issued To" and "DoD Interoperability Root CA…" under "Issued By": +If the audit settings on the Domain object are not at least as inclusive as those below, this is a finding. -Right-click on the certificate and select "Open". +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only -Select the "Details" Tab. +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. -Scroll to the bottom and select "Thumbprint". +Two instances with the following summary information will be listed. -If the certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - None +Applies to - Special -If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. +Type - Success +Principal - Domain Users +Access - All extended rights +Inherited from - None +Applies to - This object only -Issued To: DoD Root CA 2 -Issued By: DoD Interoperability Root CA 1 -Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F -Valid to: Friday, September 6, 2019 +Type - Success +Principal - Administrators +Access - All extended rights +Inherited from - None +Applies to - This object only -Issued To: DoD Root CA 3 -Issued By: DoD Interoperability Root CA 2 -Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 -Valid to: Saturday, January 22, 2022 +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner) - - <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. -Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Infrastructure object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False - Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate. - -Run "PowerShell" as an administrator. - -Execute the following command: - -Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter - -If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. - -If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. - -Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US -Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US -Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E -NotAfter: 9/27/2019 - -Alternately use the Certificates MMC snap-in: + This applies to domain controllers. It is NA for other systems. -Run "MMC". +Review the auditing configuration for Infrastructure object. -Select "File", "Add/Remove Snap-in". +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). -Select "Certificates", click "Add". +Ensure "Advanced Features" is selected in the "View" menu. -Select "Computer account", click "Next". +Select the domain being reviewed in the left pane. -Select "Local computer: (the computer this console is running on)", click "Finish". +Right-click the "Infrastructure" object in the right pane and select "Properties". -Click "OK". +Select the "Security" tab. -Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". +Select the "Advanced" button and then the "Auditing" tab. -For each certificate with "US DoD CCEB Interoperability Root CA …" under "Issued By": +If the audit settings on the Infrastructure object are not at least as inclusive as those below, this is a finding. -Right-click on the certificate and select "Open". +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None -Select the "Details" Tab. +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. -Scroll to the bottom and select "Thumbprint". +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master) -If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding. +Two instances with the following summary information will be listed. +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. -If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain Controller OU object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. -Issued To: DoD Root CA 3 -Issuer by: US DoD CCEB Interoperability Root CA 2 -Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E -Valid: Friday, September 27, 2019 - - - <VulnDiscussion>Domain controllers are part of the chain of trust for PKI authentications. Without the appropriate certificate, the authenticity of the domain controller cannot be verified. Domain controllers must have a server certificate to establish authenticity as part of PKI authentications in the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False This applies to domain controllers. It is NA for other systems. -Run "MMC". - -Select "Add/Remove Snap-in" from the "File" menu. +Review the auditing configuration for the Domain Controller OU object. -Select "Certificates" in the left pane and click the "Add >" button. +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). -Select "Computer Account" and click "Next". +Ensure "Advanced Features" is selected in the "View" menu. -Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish". +Select the "Domain Controllers OU" under the domain being reviewed in the left pane. -Click "OK". +Right-click the "Domain Controllers OU" object and select "Properties". -Select and expand the Certificates (Local Computer) entry in the left pane. +Select the "Security" tab. -Select and expand the Personal entry in the left pane. +Select the "Advanced" button and then the "Auditing" tab. -Select the Certificates entry in the left pane. +If the audit settings on the Domain Controllers OU object are not at least as inclusive as those below, this is a finding. -If no certificate for the domain controller exists in the right pane, this is a finding. +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object and all descendant objects + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: all create, delete and modify permissions) + +Type - Success +Principal - Everyone +Access - Write all properties +Inherited from - None +Applies to - This object and all descendant objects + +Two instances with the following summary information will be listed. + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objects - - <VulnDiscussion>A PKI implementation depends on the practices established by the Certificate Authority (CA) to ensure the implementation is secure. Without proper practices, the certificates issued by a CA have limited value in authentication functions. The use of multiple CAs from separate PKI implementations results in interoperability issues. If servers and clients do not have a common set of root CA certificates, they are not able to authenticate each other.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the AdminSDHolder object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False This applies to domain controllers. It is NA for other systems. -Run "MMC". - -Select "Add/Remove Snap-in" from the "File" menu. - -Select "Certificates" in the left pane and click the "Add >" button. - -Select "Computer Account" and click "Next". +Review the auditing configuration for the "AdminSDHolder" object. -Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish". +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). -Click "OK". +Ensure "Advanced Features" is selected in the "View" menu. -Select and expand the Certificates (Local Computer) entry in the left pane. +Select "System" under the domain being reviewed in the left pane. -Select and expand the Personal entry in the left pane. +Right-click the "AdminSDHolder" object in the right pane and select "Properties". -Select the Certificates entry in the left pane. +Select the "Security" tab. -In the right pane, examine the "Issued By" field for the certificate to determine the issuing CA. +Select the "Advanced" button and then the "Auditing" tab. -If the "Issued By" field of the PKI certificate being used by the domain controller does not indicate the issuing CA is part of the DoD PKI or an approved ECA, this is a finding. +If the audit settings on the "AdminSDHolder" object are not at least as inclusive as those below, this is a finding. -If the certificates in use are issued by a CA authorized by the Component's CIO, this is a CAT II finding. +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only -There are multiple sources from which lists of valid DoD CAs and approved ECAs can be obtained: +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. -The Global Directory Service (GDS) website provides an online source. The address for this site is https://crl.gds.disa.mil. +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Write all properties, Modify permissions, Modify owner) -DoD Public Key Enablement (PKE) Engineering Support maintains the InstallRoot utility to manage DoD supported root certificates on Windows computers, which includes a list of authorized CAs. The utility package can be downloaded from the PKI and PKE Tools page on IASE: +Two instances with the following summary information will be listed. -http://iase.disa.mil/pki-pke/function_pages/tools.html +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objects - - <VulnDiscussion>Smart cards such as the CAC support a two-factor authentication technique. This provides a higher level of trust in the asserted identity than use of the username and password for authentication. + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. -Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055, SRG-OS-000375-GPOS-00160</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the RID Manager$ object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False This applies to domain controllers. It is NA for other systems. -Open "PowerShell". +Review the auditing configuration for the "RID Manager$" object. -Enter the following: +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). -"Get-ADUser -Filter {(Enabled -eq $True) -and (SmartcardLogonRequired -eq $False)} | FT Name" -("DistinguishedName" may be substituted for "Name" for more detailed output.) +Ensure "Advanced Features" is selected in the "View" menu. -If any user accounts, including administrators, are listed, this is a finding. +Select "System" under the domain being reviewed in the left pane. -Alternately: +Right-click the "RID Manager$" object in the right pane and select "Properties". -To view sample accounts in "Active Directory Users and Computers" (available from various menus or run "dsa.msc"): +Select the "Security" tab. -Select the Organizational Unit (OU) where the user accounts are located. (By default, this is the Users node; however, accounts may be under other organization-defined OUs.) +Select the "Advanced" button and then the "Auditing" tab. -Right-click the sample user account and select "Properties". +If the audit settings on the "RID Manager$" object are not at least as inclusive as those below, this is a finding. -Select the "Account" tab. +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None -If any user accounts, including administrators, do not have "Smart card is required for interactive logon" checked in the "Account Options" area, this is a finding. +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None + (Access - Special = Write all properties, All extended rights, Change RID master) + +Two instances with the following summary information will be listed. + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) - - <VulnDiscussion>Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows Server 2016, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False - Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled. - -Run "System Information". + Determine if a process to back up log data to a different system or media than the system being audited has been implemented. -Under "System Summary", if "Secure Boot State" does not display "On", this is finding. +If it has not, this is a finding. - - <VulnDiscussion>UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows Server 2016, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in "Legacy BIOS" mode will not support these security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False - Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must run in "UEFI" mode. - -Verify the system firmware is configured to run in "UEFI" mode, not "Legacy BIOS". - -Run "System Information". + Verify the audit records, at a minimum, are off-loaded for interconnected systems in real time and off-loaded for standalone systems weekly. -Under "System Summary", if "BIOS Mode" does not display "UEFI", this is finding. +If they are not, this is a finding. - - <VulnDiscussion>The krbtgt account acts as a service account for the Kerberos Key Distribution Center (KDC) service. The account and password are created when a domain is created and the password is typically not changed. If the krbtgt account is compromised, attackers can create valid Kerberos Ticket Granting Tickets (TGT). + + <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. -The password must be changed twice to effectively remove the password history. Changing once, waiting for replication to complete and changing again reduces the risk of issues. Changing twice in rapid succession forces clients to re-authenticate (including application services) but is desired if a compromise is suspected.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False False - This requirement is applicable to domain controllers; it is NA for other systems. + Verify the DoD Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates. -Open "Windows PowerShell". +Run "PowerShell" as an administrator. -Enter "Get-ADUser krbtgt -Property PasswordLastSet". +Execute the following command: -If the "PasswordLastSet" date is more than 180 days old, this is a finding. - - - <VulnDiscussion>Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups. If the account or group objects are reanimated, there is a potential they may still have rights no longer intended. Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - Review the effective User Rights setting in Local Group Policy Editor. +Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter -Run "gpedit.msc". +If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. -Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. +If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. -Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of "*S-1-…".) +Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F +NotAfter: 9/6/2019 -If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding. +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 +NotAfter: 1/22/2022 - - - - - - - - - - SYSTEM - False - This folder subfolders and files - FullControl - - - - - Administrators - False - This folder subfolders and files - FullControl - - - - - Users - False - This folder subfolders and files - ReadAndExecute - - - - - Users - False - This folder and subfolders - CreateDirectories,AppendData - - - - - Users - False - Subfolders only - CreateFiles,WriteData - - - - - CREATOR OWNER - False - Subfolders and files only - FullControl - - - <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. +Alternately use the Certificates MMC snap-in: -The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). +Run "MMC". -Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - %SystemDrive%\ - The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). +Select "File", "Add/Remove Snap-in". -Review the permissions for the system drive's root directory (usually C:\). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) +Select "Certificates", click "Add". -If permissions are not as restrictive as the default permissions listed below, this is a finding. +Select "Computer account", click "Next". -Viewing in File Explorer: +Select "Local computer: (the computer this console is running on)", click "Finish". -View the Properties of the system drive's root directory. +Click "OK". -Select the "Security" tab, and the "Advanced" button. +Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". -Default permissions: -C:\ -Type - "Allow" for all -Inherited from - "None" for all +For each certificate with "DoD Root CA…" under "Issued To" and "DoD Interoperability Root CA…" under "Issued By": -Principal - Access - Applies to +Right-click on the certificate and select "Open". -SYSTEM - Full control - This folder, subfolders, and files -Administrators - Full control - This folder, subfolders, and files -Users - Read & execute - This folder, subfolders, and files -Users - Create folders/append data - This folder and subfolders -Users - Create files/write data - Subfolders only -CREATOR OWNER - Full Control - Subfolders and files only +Select the "Details" Tab. -Alternately, use icacls: +Scroll to the bottom and select "Thumbprint". -Open "Command Prompt (Admin)". +If the certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. -Enter "icacls" followed by the directory: +If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. -"icacls c:\" +Issued To: DoD Root CA 2 +Issued By: DoD Interoperability Root CA 1 +Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F +Valid to: Friday, September 6, 2019 -The following results should be displayed: +Issued To: DoD Root CA 3 +Issued By: DoD Interoperability Root CA 2 +Thumbprint: AC06108CA348CC03B53795C64BF84403C1DBD341 +Valid to: Saturday, January 22, 2022 + + + <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. -c:\ -NT AUTHORITY\SYSTEM:(OI)(CI)(F) -BUILTIN\Administrators:(OI)(CI)(F) -BUILTIN\Users:(OI)(CI)(RX) -BUILTIN\Users:(CI)(AD) -BUILTIN\Users:(CI)(IO)(WD) -CREATOR OWNER:(OI)(CI)(IO)(F) -Successfully processed 1 files; Failed processing 0 files +Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify the US DoD CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate. + +Run "PowerShell" as an administrator. + +Execute the following command: + +Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter + +If the following certificate "Subject", "Issuer", and "Thumbprint", information is not displayed, this is finding. + +If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. + +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E +NotAfter: 9/27/2019 + +Alternately use the Certificates MMC snap-in: + +Run "MMC". + +Select "File", "Add/Remove Snap-in". + +Select "Certificates", click "Add". + +Select "Computer account", click "Next". + +Select "Local computer: (the computer this console is running on)", click "Finish". + +Click "OK". + +Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". + +For each certificate with "US DoD CCEB Interoperability Root CA …" under "Issued By": + +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. + +Issued To: DoD Root CA 3 +Issuer by: US DoD CCEB Interoperability Root CA 2 +Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E +Valid: Friday, September 27, 2019 - - - - - - TrustedInstaller - False - This folder and subfolders - FullControl - - - - - SYSTEM - False - This folder only - Modify - - - - - SYSTEM - False - Subfolders and files only - FullControl - - - - - Administrators - False - This folder only - Modify - - - - - Administrators - False - Subfolders and files only - FullControl - - - - - Users - False - This folder subfolders and files - ReadAndExecute - - - - - CREATOR OWNER - False - Subfolders and files only - FullControl - - - - - ALL APPLICATION PACKAGES - False - This folder subfolders and files - ReadAndExecute - - - - - ALL RESTRICTED APPLICATION PACKAGES - False - This folder subfolders and files - ReadAndExecute - - - <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + + <VulnDiscussion>Domain controllers are part of the chain of trust for PKI authentications. Without the appropriate certificate, the authenticity of the domain controller cannot be verified. Domain controllers must have a server certificate to establish authenticity as part of PKI authentications in the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. -The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). +Run "MMC". -Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +Select "Add/Remove Snap-in" from the "File" menu. + +Select "Certificates" in the left pane and click the "Add >" button. + +Select "Computer Account" and click "Next". + +Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish". + +Click "OK". + +Select and expand the Certificates (Local Computer) entry in the left pane. + +Select and expand the Personal entry in the left pane. + +Select the Certificates entry in the left pane. + +If no certificate for the domain controller exists in the right pane, this is a finding. + + + <VulnDiscussion>A PKI implementation depends on the practices established by the Certificate Authority (CA) to ensure the implementation is secure. Without proper practices, the certificates issued by a CA have limited value in authentication functions. The use of multiple CAs from separate PKI implementations results in interoperability issues. If servers and clients do not have a common set of root CA certificates, they are not able to authenticate each other.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - True False False - %ProgramFiles(x86)% - The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). -Review the permissions for the program file directories (Program Files and Program Files [x86]). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. (Individual accounts must not be used to assign permissions.) -If permissions are not as restrictive as the default permissions listed below, this is a finding. -Viewing in File Explorer: -For each folder, view the Properties. -Select the "Security" tab, and the "Advanced" button. -Default permissions: -\Program Files (x86) -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -TrustedInstaller - Full control - This folder and subfolders -SYSTEM - Modify - This folder only -SYSTEM - Full control - Subfolders and files only -Administrators - Modify - This folder only -Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders and files -CREATOR OWNER - Full control - Subfolders and files only -ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files -ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files -Alternately, use icacls: -Open a Command prompt (admin). -Enter "icacls" followed by the directory: -'icacls "c:\program files"' -'icacls "c:\program files (x86)"' -The following results should be displayed for each when entered: -c:\program files (c:\program files (x86)) -NT SERVICE\TrustedInstaller:(F) -NT SERVICE\TrustedInstaller:(CI)(IO)(F) -NT AUTHORITY\SYSTEM:(M) -NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) -BUILTIN\Administrators:(M) -BUILTIN\Administrators:(OI)(CI)(IO)(F) -BUILTIN\Users:(RX) -BUILTIN\Users:(OI)(CI)(IO)(GR,GE) -CREATOR OWNER:(OI)(CI)(IO)(F) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -Successfully processed 1 files; Failed processing 0 files + This applies to domain controllers. It is NA for other systems. + +Run "MMC". + +Select "Add/Remove Snap-in" from the "File" menu. + +Select "Certificates" in the left pane and click the "Add >" button. + +Select "Computer Account" and click "Next". + +Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish". + +Click "OK". + +Select and expand the Certificates (Local Computer) entry in the left pane. + +Select and expand the Personal entry in the left pane. + +Select the Certificates entry in the left pane. + +In the right pane, examine the "Issued By" field for the certificate to determine the issuing CA. + +If the "Issued By" field of the PKI certificate being used by the domain controller does not indicate the issuing CA is part of the DoD PKI or an approved ECA, this is a finding. + +If the certificates in use are issued by a CA authorized by the Component's CIO, this is a CAT II finding. + +There are multiple sources from which lists of valid DoD CAs and approved ECAs can be obtained: + +The Global Directory Service (GDS) website provides an online source. The address for this site is https://crl.gds.disa.mil. + +DoD Public Key Enablement (PKE) Engineering Support maintains the InstallRoot utility to manage DoD supported root certificates on Windows computers, which includes a list of authorized CAs. The utility package can be downloaded from the PKI and PKE Tools page on IASE: + +http://iase.disa.mil/pki-pke/function_pages/tools.html + + + <VulnDiscussion>Smart cards such as the CAC support a two-factor authentication technique. This provides a higher level of trust in the asserted identity than use of the username and password for authentication. + +Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055, SRG-OS-000375-GPOS-00160</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Open "PowerShell". + +Enter the following: + +"Get-ADUser -Filter {(Enabled -eq $True) -and (SmartcardLogonRequired -eq $False)} | FT Name" +("DistinguishedName" may be substituted for "Name" for more detailed output.) + +If any user accounts, including administrators, are listed, this is a finding. + +Alternately: + +To view sample accounts in "Active Directory Users and Computers" (available from various menus or run "dsa.msc"): + +Select the Organizational Unit (OU) where the user accounts are located. (By default, this is the Users node; however, accounts may be under other organization-defined OUs.) + +Right-click the sample user account and select "Properties". + +Select the "Account" tab. + +If any user accounts, including administrators, do not have "Smart card is required for interactive logon" checked in the "Account Options" area, this is a finding. + + + <VulnDiscussion>Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows Server 2016, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled. + +Run "System Information". + +Under "System Summary", if "Secure Boot State" does not display "On", this is finding. + + + <VulnDiscussion>UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows Server 2016, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in "Legacy BIOS" mode will not support these security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must run in "UEFI" mode. + +Verify the system firmware is configured to run in "UEFI" mode, not "Legacy BIOS". + +Run "System Information". + +Under "System Summary", if "BIOS Mode" does not display "UEFI", this is finding. + + + <VulnDiscussion>The krbtgt account acts as a service account for the Kerberos Key Distribution Center (KDC) service. The account and password are created when a domain is created and the password is typically not changed. If the krbtgt account is compromised, attackers can create valid Kerberos Ticket Granting Tickets (TGT). + +The password must be changed twice to effectively remove the password history. Changing once, waiting for replication to complete and changing again reduces the risk of issues. Changing twice in rapid succession forces clients to re-authenticate (including application services) but is desired if a compromise is suspected.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This requirement is applicable to domain controllers; it is NA for other systems. + +Open "Windows PowerShell". + +Enter "Get-ADUser krbtgt -Property PasswordLastSet". + +If the "PasswordLastSet" date is more than 180 days old, this is a finding. + + + <VulnDiscussion>Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups. If the account or group objects are reanimated, there is a potential they may still have rights no longer intended. Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the effective User Rights setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of "*S-1-…".) + +If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding. + - + + + - - - - TrustedInstaller - False - This folder and subfolders - FullControl - - - - - SYSTEM - False - This folder only - Modify - SYSTEM False - Subfolders and files only + This folder subfolders and files FullControl @@ -2988,15 +3062,7 @@ Successfully processed 1 files; Failed processing 0 files Administrators False - This folder only - Modify - - - - - Administrators - False - Subfolders and files only + This folder subfolders and files FullControl @@ -3010,26 +3076,26 @@ Successfully processed 1 files; Failed processing 0 files - CREATOR OWNER + Users False - Subfolders and files only - FullControl + This folder and subfolders + CreateDirectories,AppendData - ALL APPLICATION PACKAGES + Users False - This folder subfolders and files - ReadAndExecute + Subfolders only + CreateFiles,WriteData - ALL RESTRICTED APPLICATION PACKAGES + CREATOR OWNER False - This folder subfolders and files - ReadAndExecute + Subfolders and files only + FullControl <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. @@ -3042,51 +3108,53 @@ Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPO False False - %ProgramFiles% + %SystemDrive%\ The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). -Review the permissions for the program file directories (Program Files and Program Files [x86]). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. (Individual accounts must not be used to assign permissions.) + +Review the permissions for the system drive's root directory (usually C:\). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) + If permissions are not as restrictive as the default permissions listed below, this is a finding. + Viewing in File Explorer: -For each folder, view the Properties. + +View the Properties of the system drive's root directory. + Select the "Security" tab, and the "Advanced" button. + Default permissions: -\Program Files +C:\ Type - "Allow" for all Inherited from - "None" for all + Principal - Access - Applies to -TrustedInstaller - Full control - This folder and subfolders -SYSTEM - Modify - This folder only -SYSTEM - Full control - Subfolders and files only -Administrators - Modify - This folder only -Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders and files -CREATOR OWNER - Full control - Subfolders and files only -ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files -ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files + +SYSTEM - Full control - This folder, subfolders, and files +Administrators - Full control - This folder, subfolders, and files +Users - Read & execute - This folder, subfolders, and files +Users - Create folders/append data - This folder and subfolders +Users - Create files/write data - Subfolders only +CREATOR OWNER - Full Control - Subfolders and files only + Alternately, use icacls: -Open a Command prompt (admin). + +Open "Command Prompt (Admin)". + Enter "icacls" followed by the directory: -'icacls "c:\program files"' -'icacls "c:\program files (x86)"' -The following results should be displayed for each when entered: -c:\program files (c:\program files (x86)) -NT SERVICE\TrustedInstaller:(F) -NT SERVICE\TrustedInstaller:(CI)(IO)(F) -NT AUTHORITY\SYSTEM:(M) -NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) -BUILTIN\Administrators:(M) -BUILTIN\Administrators:(OI)(CI)(IO)(F) -BUILTIN\Users:(RX) -BUILTIN\Users:(OI)(CI)(IO)(GR,GE) + +"icacls c:\" + +The following results should be displayed: + +c:\ +NT AUTHORITY\SYSTEM:(OI)(CI)(F) +BUILTIN\Administrators:(OI)(CI)(F) +BUILTIN\Users:(OI)(CI)(RX) +BUILTIN\Users:(CI)(AD) +BUILTIN\Users:(CI)(IO)(WD) CREATOR OWNER:(OI)(CI)(IO)(F) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) -APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -Successfully processed 1 files; Failed processing 0 files - +Successfully processed 1 files; Failed processing 0 files - + @@ -3171,47 +3239,34 @@ Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPO False False - %windir% + %ProgramFiles(x86)% The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). - -Review the permissions for the Windows installation directory (usually C:\Windows). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. (Individual accounts must not be used to assign permissions.) - +Review the permissions for the program file directories (Program Files and Program Files [x86]). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. (Individual accounts must not be used to assign permissions.) If permissions are not as restrictive as the default permissions listed below, this is a finding. - Viewing in File Explorer: - For each folder, view the Properties. - -Select the "Security" tab and the "Advanced" button. - +Select the "Security" tab, and the "Advanced" button. Default permissions: -\Windows +\Program Files (x86) Type - "Allow" for all Inherited from - "None" for all - Principal - Access - Applies to - TrustedInstaller - Full control - This folder and subfolders SYSTEM - Modify - This folder only SYSTEM - Full control - Subfolders and files only Administrators - Modify - This folder only Administrators - Full control - Subfolders and files only -Users - Read & execute - This folder, subfolders, and files +Users - Read & execute - This folder, subfolders and files CREATOR OWNER - Full control - Subfolders and files only ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files - Alternately, use icacls: - Open a Command prompt (admin). - Enter "icacls" followed by the directory: - -"icacls c:\windows" - +'icacls "c:\program files"' +'icacls "c:\program files (x86)"' The following results should be displayed for each when entered: - -c:\windows +c:\program files (c:\program files (x86)) NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) @@ -3225,58 +3280,17 @@ APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) -Successfully processed 1 files; Failed processing 0 files - - - - - - - SYSTEM - False - This Key and Subkeys - FullControl - - - <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - HKLM:\SECURITY - Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. -If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. -If permissions are not as restrictive as the default permissions listed below, this is a finding. -Run "Regedit". -Right-click on the registry areas noted below. -Select "Permissions..." and the "Advanced" button. -HKEY_LOCAL_MACHINE\SECURITY -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -SYSTEM - Full Control - This key and subkeys -Administrators - Special - This key and subkeys -Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. -If the defaults have not been changed, these are not a finding. +Successfully processed 1 files; Failed processing 0 files - + - Users - False - This Key and Subkeys - ReadKey - - - - - Administrators + TrustedInstaller False - This Key and Subkeys + This folder and subfolders FullControl @@ -3284,146 +3298,40 @@ If the defaults have not been changed, these are not a finding. SYSTEM False - This Key and Subkeys - FullControl - - - - - CREATOR OWNER - False - This Key and Subkeys - FullControl - - - - - ALL APPLICATION PACKAGES - False - This Key and Subkeys - ReadKey - - - <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - HKLM:\SOFTWARE - Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. -If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. -If permissions are not as restrictive as the default permissions listed below, this is a finding. -Run "Regedit". -Right-click on the registry areas noted below. -Select "Permissions..." and the "Advanced" button. -HKEY_LOCAL_MACHINE\SOFTWARE -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -Users - Read - This key and subkeys -Administrators - Full Control - This key and subkeys -SYSTEM - Full Control - This key and subkeys -CREATOR OWNER - Full Control - This key and subkeys -ALL APPLICATION PACKAGES - Read - This key and subkeys -Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. -If the defaults have not been changed, these are not a finding. - - - - - - - - Users - False - This Key and Subkeys - ReadKey - - - - - Administrators - False - This Key and Subkeys - FullControl + This folder only + Modify SYSTEM False - This Key and Subkeys - FullControl - - - - - CREATOR OWNER - False - Subkeys Only + Subfolders and files only FullControl - ALL APPLICATION PACKAGES - False - This Key and Subkeys - ReadKey - - - <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - HKLM:\SYSTEM - Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. -If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. -If permissions are not as restrictive as the default permissions listed below, this is a finding. -Run "Regedit". -Right-click on the registry areas noted below. -Select "Permissions..." and the "Advanced" button. -HKEY_LOCAL_MACHINE\SYSTEM -Type - "Allow" for all -Inherited from - "None" for all -Principal - Access - Applies to -Users - Read - This key and subkeys -Administrators - Full Control - This key and subkeys -SYSTEM - Full Control - This key and subkeys -CREATOR OWNER - Full Control - Subkeys only -ALL APPLICATION PACKAGES - Read - This key and subkeys -Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. -If the defaults have not been changed, these are not a finding. - - - - - - - - Authenticated Users + Administrators False - This folder subfolders and files - ReadAndExecute + This folder only + Modify - Server Operators + Administrators False - This folder subfolders and files - ReadAndExecute + Subfolders and files only + FullControl - Administrators + Users False - This folder only - AppendData,ChangePermissions,CreateDirectories,CreateFiles,Delete,DeleteSubdirectoriesAndFiles,ExecuteFile,ListDirectory,Modify,Read,ReadAndExecute,ReadAttributes,ReadData,ReadExtendedAttributes,ReadPermissions,Synchronize,TakeOwnership,Traverse,Write,WriteAttributes,WriteData,WriteExtendedAttributes + This folder subfolders and files + ReadAndExecute @@ -3436,708 +3344,504 @@ If the defaults have not been changed, these are not a finding. - Administrators + ALL APPLICATION PACKAGES False - Subfolders and files only - FullControl + This folder subfolders and files + ReadAndExecute - SYSTEM + ALL RESTRICTED APPLICATION PACKAGES False This folder subfolders and files - FullControl + ReadAndExecute - <VulnDiscussion>Improper access permissions for directory data files could allow unauthorized users to read, modify, or delete directory data. + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. -The SYSVOL directory contains public files (to the domain) such as policies and logon scripts. Data in shared subdirectories are replicated to all domain controllers in a domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> +The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> True False False - %windir%\sysvol - This applies to domain controllers. It is NA for other systems. - -Open a command prompt. - -Run "net share". - -Make note of the directory location of the SYSVOL share. - -By default, this will be \Windows\SYSVOL\sysvol. For this requirement, permissions will be verified at the first SYSVOL directory level. - -If any standard user accounts or groups have greater than "Read & execute" permissions, this is a finding. - -The default permissions noted below meet this requirement. - -Open "Command Prompt". - -Run "icacls c:\Windows\SYSVOL". - -The following results should be displayed: - -NT AUTHORITY\Authenticated Users:(RX) -NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(GR,GE) -BUILTIN\Server Operators:(RX) -BUILTIN\Server Operators:(OI)(CI)(IO)(GR,GE) -BUILTIN\Administrators:(M,WDAC,WO) -BUILTIN\Administrators:(OI)(CI)(IO)(F) -NT AUTHORITY\SYSTEM:(F) -NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) -BUILTIN\Administrators:(M,WDAC,WO) -CREATOR OWNER:(OI)(CI)(IO)(F) - -(RX) - Read & execute - -Run "icacls /help" to view definitions of other permission codes. - -Alternately, open "File Explorer". - -Navigate to \Windows\SYSVOL (or the directory noted previously if different). - -Right-click the directory and select properties. - -Select the "Security" tab and click "Advanced". - + %ProgramFiles% + The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). +Review the permissions for the program file directories (Program Files and Program Files [x86]). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. (Individual accounts must not be used to assign permissions.) +If permissions are not as restrictive as the default permissions listed below, this is a finding. +Viewing in File Explorer: +For each folder, view the Properties. +Select the "Security" tab, and the "Advanced" button. Default permissions: - -C:\Windows\SYSVOL +\Program Files Type - "Allow" for all Inherited from - "None" for all - Principal - Access - Applies to - -Authenticated Users - Read & execute- This folder, subfolder, and files -Server Operators - Read & execute- This folder, subfolder, and files -Administrators - Special - This folder only (Special = Basic Permissions: all selected except Full control) -CREATOR OWNER - Full control - Subfolders and files only +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only Administrators - Full control - Subfolders and files only -SYSTEM - Full control - This folder, subfolders, and files +Users - Read & execute - This folder, subfolders and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +Alternately, use icacls: +Open a Command prompt (admin). +Enter "icacls" followed by the directory: +'icacls "c:\program files"' +'icacls "c:\program files (x86)"' +The following results should be displayed for each when entered: +c:\program files (c:\program files (x86)) +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 files + - + - CREATOR OWNER - False - - - - - - - - - Self - False - - - - - - - - - Authenticated Users + TrustedInstaller False - - - - + This folder and subfolders + FullControl SYSTEM False - - - - - - - - - Domain Admins - False - - - - - - - - - Enterprise Admins - False - - - - + This folder only + Modify - Key Admins + SYSTEM False - - - - + Subfolders and files only + FullControl - Enterprise Key Admins + Administrators False - - - - + This folder only + Modify Administrators False - - - - + Subfolders and files only + FullControl - Pre-Windows 2000 Compatible Access + Users False - - - - + This folder subfolders and files + ReadAndExecute - ENTERPRISE DOMAIN CONTROLLERS - False - - - - - - - <VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. - -For Active Directory, the OU objects require special attention. In a distributed administration model (i.e., help desk), OU objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for OU objects, it could allow an intruder to add or delete users in the OU. This could result in unauthorized access to data or a denial of service to authorized users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - - This applies to domain controllers. It is NA for other systems. - -Review the permissions on domain-defined OUs. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -For each OU that is defined (folder in folder icon) excluding the Domain Controllers OU: - -Right-click the OU and select "Properties". - -Select the "Security" tab. - -If the permissions on the OU are not at least as restrictive as those below, this is a finding. - -The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "Edit" or "View" button. - -Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. - -CREATOR OWNER - Special permissions - -Self - Special permissions - -Authenticated Users - Read, Special permissions - -The Special permissions for Authenticated Users are Read type. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -SYSTEM - Full Control - -Domain Admins - Full Control - -Enterprise Admins - Full Control - -Key Admins - Special permissions - -Enterprise Key Admins - Special permissions - -Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Pre-Windows 2000 Compatible Access - Special permissions - -The Special permissions for Pre-Windows 2000 Compatible Access are for Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions - -If an ISSO-approved distributed administration model (help desk or other user support staff) is implemented, permissions above Read may be allowed for groups documented by the ISSO. - -If any OU with improper permissions includes identification or authentication data (e.g., accounts, passwords, or password hash data) used by systems to determine access control, the severity is CAT I (e.g., OUs that include user accounts, including service/application accounts). - -If an OU with improper permissions does not include identification and authentication data used by systems to determine access control, the severity is CAT II (e.g., Workstation, Printer OUs). - - - - - Fail - Everyone - False - - - - - - - Success - Everyone - False - - - - - - - Success - Domain Users + CREATOR OWNER False - - - - + Subfolders and files only + FullControl - Success - Administrators + + + ALL APPLICATION PACKAGES False - - - - + This folder subfolders and files + ReadAndExecute - Success - Everyone + + + ALL RESTRICTED APPLICATION PACKAGES False - - - - + This folder subfolders and files + ReadAndExecute - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. +The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-73377 +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + True False False - - This applies to domain controllers. It is NA for other systems. - -Review the auditing configuration for the Domain object. + %windir% + The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290). -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). +Review the permissions for the Windows installation directory (usually C:\Windows). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. (Individual accounts must not be used to assign permissions.) -Ensure "Advanced Features" is selected in the "View" menu. +If permissions are not as restrictive as the default permissions listed below, this is a finding. -Select the domain being reviewed in the left pane. +Viewing in File Explorer: -Right-click the domain name and select "Properties". +For each folder, view the Properties. -Select the "Security" tab. +Select the "Security" tab and the "Advanced" button. -Select the "Advanced" button and then the "Auditing" tab. +Default permissions: +\Windows +Type - "Allow" for all +Inherited from - "None" for all -If the audit settings on the Domain object are not at least as inclusive as those below, this is a finding. +Principal - Access - Applies to -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object only +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders, and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. +Alternately, use icacls: -Two instances with the following summary information will be listed. +Open a Command prompt (admin). -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - None -Applies to - Special +Enter "icacls" followed by the directory: -Type - Success -Principal - Domain Users -Access - All extended rights -Inherited from - None -Applies to - This object only +"icacls c:\windows" -Type - Success -Principal - Administrators -Access - All extended rights -Inherited from - None -Applies to - This object only +The following results should be displayed for each when entered: -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner) +c:\windows +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 files - + - Fail - Everyone + + + SYSTEM False - - - - + This Key and Subkeys + FullControl + + + <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + HKLM:\SECURITY + Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. +If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. +If permissions are not as restrictive as the default permissions listed below, this is a finding. +Run "Regedit". +Right-click on the registry areas noted below. +Select "Permissions..." and the "Advanced" button. +HKEY_LOCAL_MACHINE\SECURITY +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +SYSTEM - Full Control - This key and subkeys +Administrators - Special - This key and subkeys +Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. +If the defaults have not been changed, these are not a finding. + + + + + + + + Users + False + This Key and Subkeys + ReadKey - Success - Everyone + + + Administrators False - - - - + This Key and Subkeys + FullControl - Success - Everyone + + + SYSTEM False - - - - + This Key and Subkeys + FullControl + + + + + CREATOR OWNER + False + This Key and Subkeys + FullControl + + + + + ALL APPLICATION PACKAGES + False + This Key and Subkeys + ReadKey - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Infrastructure object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-73377 + <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + True False False - - This applies to domain controllers. It is NA for other systems. - -Review the auditing configuration for Infrastructure object. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -Select the domain being reviewed in the left pane. - -Right-click the "Infrastructure" object in the right pane and select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button and then the "Auditing" tab. - -If the audit settings on the Infrastructure object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master) - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) + HKLM:\SOFTWARE + Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. +If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. +If permissions are not as restrictive as the default permissions listed below, this is a finding. +Run "Regedit". +Right-click on the registry areas noted below. +Select "Permissions..." and the "Advanced" button. +HKEY_LOCAL_MACHINE\SOFTWARE +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +Users - Read - This key and subkeys +Administrators - Full Control - This key and subkeys +SYSTEM - Full Control - This key and subkeys +CREATOR OWNER - Full Control - This key and subkeys +ALL APPLICATION PACKAGES - Read - This key and subkeys +Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. +If the defaults have not been changed, these are not a finding. + - + - Fail - Everyone + + + Users False - - - - + This Key and Subkeys + ReadKey - Success - Everyone + + + Administrators False - - - - + This Key and Subkeys + FullControl + + + + + SYSTEM + False + This Key and Subkeys + FullControl - Success - Everyone + + + CREATOR OWNER False - - - - + Subkeys Only + FullControl - Success - Everyone + + + ALL APPLICATION PACKAGES False - - - - + This Key and Subkeys + ReadKey - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain Controller OU object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-73377 + <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + True False False - - This applies to domain controllers. It is NA for other systems. - -Review the auditing configuration for the Domain Controller OU object. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -Select the "Domain Controllers OU" under the domain being reviewed in the left pane. - -Right-click the "Domain Controllers OU" object and select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button and then the "Auditing" tab. - -If the audit settings on the Domain Controllers OU object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object and all descendant objects - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Permissions: all create, delete and modify permissions) - -Type - Success -Principal - Everyone -Access - Write all properties -Inherited from - None -Applies to - This object and all descendant objects - -Two instances with the following summary information will be listed. - -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) -Applies to - Descendant Organizational Unit objects + HKLM:\SYSTEM + Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. +If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. +If permissions are not as restrictive as the default permissions listed below, this is a finding. +Run "Regedit". +Right-click on the registry areas noted below. +Select "Permissions..." and the "Advanced" button. +HKEY_LOCAL_MACHINE\SYSTEM +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +Users - Read - This key and subkeys +Administrators - Full Control - This key and subkeys +SYSTEM - Full Control - This key and subkeys +CREATOR OWNER - Full Control - Subkeys only +ALL APPLICATION PACKAGES - Read - This key and subkeys +Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. +If the defaults have not been changed, these are not a finding. + - + - Fail - Everyone + + + Authenticated Users False - - - - + This folder subfolders and files + ReadAndExecute - Success - Everyone + + + Server Operators False - - - - + This folder subfolders and files + ReadAndExecute - Success - Everyone + + + Administrators False - - - - + This folder only + AppendData,ChangePermissions,CreateDirectories,CreateFiles,Delete,DeleteSubdirectoriesAndFiles,ExecuteFile,ListDirectory,Modify,Read,ReadAndExecute,ReadAttributes,ReadData,ReadExtendedAttributes,ReadPermissions,Synchronize,TakeOwnership,Traverse,Write,WriteAttributes,WriteData,WriteExtendedAttributes - - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the AdminSDHolder object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. - -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-73377 - True - False - False - - - This applies to domain controllers. It is NA for other systems. - -Review the auditing configuration for the "AdminSDHolder" object. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -Select "System" under the domain being reviewed in the left pane. - -Right-click the "AdminSDHolder" object in the right pane and select "Properties". - -Select the "Security" tab. - -Select the "Advanced" button and then the "Auditing" tab. - -If the audit settings on the "AdminSDHolder" object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object only - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Write all properties, Modify permissions, Modify owner) - -Two instances with the following summary information will be listed. - -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) -Applies to - Descendant Organizational Unit objects - - - - Fail - Everyone + + + CREATOR OWNER False - - - - + Subfolders and files only + FullControl - Success - Everyone + + + Administrators False - - - - + Subfolders and files only + FullControl - Success - Everyone + + + SYSTEM False - - - - + This folder subfolders and files + FullControl - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the RID Manager$ object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + <VulnDiscussion>Improper access permissions for directory data files could allow unauthorized users to read, modify, or delete directory data. -Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-73377 +The SYSVOL directory contains public files (to the domain) such as policies and logon scripts. Data in shared subdirectories are replicated to all domain controllers in a domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + True False False - + %windir%\sysvol This applies to domain controllers. It is NA for other systems. -Review the auditing configuration for the "RID Manager$" object. +Open a command prompt. -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). +Run "net share". -Ensure "Advanced Features" is selected in the "View" menu. +Make note of the directory location of the SYSVOL share. -Select "System" under the domain being reviewed in the left pane. +By default, this will be \Windows\SYSVOL\sysvol. For this requirement, permissions will be verified at the first SYSVOL directory level. -Right-click the "RID Manager$" object in the right pane and select "Properties". +If any standard user accounts or groups have greater than "Read & execute" permissions, this is a finding. -Select the "Security" tab. +The default permissions noted below meet this requirement. -Select the "Advanced" button and then the "Auditing" tab. +Open "Command Prompt". -If the audit settings on the "RID Manager$" object are not at least as inclusive as those below, this is a finding. +Run "icacls c:\Windows\SYSVOL". -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None +The following results should be displayed: -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. +NT AUTHORITY\Authenticated Users:(RX) +NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(GR,GE) +BUILTIN\Server Operators:(RX) +BUILTIN\Server Operators:(OI)(CI)(IO)(GR,GE) +BUILTIN\Administrators:(M,WDAC,WO) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(F) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M,WDAC,WO) +CREATOR OWNER:(OI)(CI)(IO)(F) -Type - Success -Principal - Everyone -Access - Special -Inherited from - None - (Access - Special = Write all properties, All extended rights, Change RID master) +(RX) - Read & execute -Two instances with the following summary information will be listed. +Run "icacls /help" to view definitions of other permission codes. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) +Alternately, open "File Explorer". + +Navigate to \Windows\SYSVOL (or the directory noted previously if different). + +Right-click the directory and select properties. + +Select the "Security" tab and click "Advanced". + +Default permissions: + +C:\Windows\SYSVOL +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +Authenticated Users - Read & execute- This folder, subfolder, and files +Server Operators - Read & execute- This folder, subfolder, and files +Administrators - Special - This folder only (Special = Basic Permissions: all selected except Full control) +CREATOR OWNER - Full control - Subfolders and files only +Administrators - Full control - Subfolders and files only +SYSTEM - Full control - This folder, subfolders, and files diff --git a/StigData/Processed/WindowsServer-2016-MS-1.9.org.default.xml b/StigData/Processed/WindowsServer-2016-MS-1.9.org.default.xml index 2781b5c5d..a0fe74139 100644 --- a/StigData/Processed/WindowsServer-2016-MS-1.9.org.default.xml +++ b/StigData/Processed/WindowsServer-2016-MS-1.9.org.default.xml @@ -8,8 +8,6 @@ - - diff --git a/Tests/Unit/Module/STIG.tests.ps1 b/Tests/Unit/Module/STIG.tests.ps1 index 6437c2e6a..5ddb5c2db 100644 --- a/Tests/Unit/Module/STIG.tests.ps1 +++ b/Tests/Unit/Module/STIG.tests.ps1 @@ -240,7 +240,7 @@ try It "Should return $($sample.TechnologyVersion) as the TechnologyVersion property" { $benchmarkId.TechnologyVersion | Should Be $sample.TechnologyVersion } - + It "Should return $($sample.TechnologyRole) as the TechnologyRole property" { $benchmarkId.TechnologyRole | Should Be $sample.TechnologyRole @@ -250,6 +250,12 @@ try } } } + Describe 'Conversion Status' { + It 'Should not contain conversionstatus="fail" in any processed STIG' { + $selectStringResults = Select-String -Pattern 'conversionstatus="fail"' -Path "$PSScriptRoot\..\..\..\StigData\Processed\*.xml" + $selectStringResults | Should Be $null + } + } #endregion } finally From 7d8afc65bf06bafa45ae707ed0d8871cf04d6414 Mon Sep 17 00:00:00 2001 From: Brian Wilhite Date: Fri, 6 Dec 2019 19:04:28 -0500 Subject: [PATCH 18/42] Update PowerSTIG to parse and apply OfficeSystem 2013 STIG V1R9 / 2016 V1R1 (#553) * added Office-System2013 STIG support. * reconverted xccdfs, corrected issues in some processed stigs. * added OfficeSystem 2016 V1R1 STIG * updated changelog.md --- CHANGELOG.md | 1 + .../Convert/Functions.SingleLine.ps1 | 2 +- ...ficeSystem_2013_STIG_V1R9_Manual-xccdf.log | 6 + ...ficeSystem_2013_STIG_V1R9_Manual-xccdf.xml | 1834 +++++++++++++++++ ...ice_System_2016_STIG_V1R1_Manual-xccdf.log | 5 + ..._2012_Database_STIG_V1R17_Manual-xccdf.xml | 827 -------- ...ozilla_FireFox_STIG_V4R25_Manual-xccdf.xml | 135 -- StigData/Processed/IISSite-8.5-1.8.xml | 4 +- .../Processed/InternetExplorer-11-1.17.xml | 100 +- .../Processed/InternetExplorer-11-1.18.xml | 82 +- .../Office-System2013-1.9.org.default.xml | 17 + StigData/Processed/Office-System2013-1.9.xml | 993 +++++++++ .../Office-System2016-1.1.org.default.xml | 8 + StigData/Processed/Office-System2016-1.1.xml | 447 ++++ .../SqlServer-2012-Instance-1.19.xml | 1186 +++++------ .../Processed/SqlServer-2016-Instance-1.7.xml | 10 +- .../Processed/WindowsDefender-All-1.5.xml | 16 +- .../Processed/WindowsDefender-All-1.6.xml | 16 +- .../WindowsDnsServer-2012R2-1.12.xml | 122 +- .../WindowsServer-2012R2-DC-2.18.xml | 4 +- .../WindowsServer-2012R2-MS-2.17.xml | 360 ++-- 21 files changed, 4262 insertions(+), 1913 deletions(-) create mode 100644 StigData/Archive/Office/U_MS_OfficeSystem_2013_STIG_V1R9_Manual-xccdf.log create mode 100644 StigData/Archive/Office/U_MS_OfficeSystem_2013_STIG_V1R9_Manual-xccdf.xml create mode 100644 StigData/Archive/Office/U_Microsoft_Office_System_2016_STIG_V1R1_Manual-xccdf.log delete mode 100644 StigData/Archive/SQL Server/U_SQL_Server_2012_Database_STIG_V1R17_Manual-xccdf.xml delete mode 100644 StigData/Archive/browser/U_Mozilla_FireFox_STIG_V4R25_Manual-xccdf.xml create mode 100644 StigData/Processed/Office-System2013-1.9.org.default.xml create mode 100644 StigData/Processed/Office-System2013-1.9.xml create mode 100644 StigData/Processed/Office-System2016-1.1.org.default.xml create mode 100644 StigData/Processed/Office-System2016-1.1.xml diff --git a/CHANGELOG.md b/CHANGELOG.md index 3048220c9..702ff0ee7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,7 @@ * Update PowerSTIG to parse/convert the Windows Server 2012 R2 MS/DC V2R17/V2R18 Respectively: [531](https://github.com/microsoft/PowerStig/issues/531) * Need a test to verify the conversionstatus="fail" does not exist in processed STIGs: [545](https://github.com/microsoft/PowerStig/issues/545) * Update PowerSTIG to successfully parse Microsoft SQL Server 2016 Instance STIG - Ver 1, Rel 7: [#542](https://github.com/microsoft/PowerStig/issues/542) +* Update PowerSTIG to parse and apply OfficeSystem 2013 STIG V1R9 / 2016 V1R1: [#551](https://github.com/microsoft/PowerStig/issues/551) ## 4.1.1 diff --git a/Module/Rule.Registry/Convert/Functions.SingleLine.ps1 b/Module/Rule.Registry/Convert/Functions.SingleLine.ps1 index 332803c32..9f7c2f137 100644 --- a/Module/Rule.Registry/Convert/Functions.SingleLine.ps1 +++ b/Module/Rule.Registry/Convert/Functions.SingleLine.ps1 @@ -390,7 +390,7 @@ function Get-RegistryValueNameFromSLStig if ($valueName) { - $valueName = $valueName.Matches.Value -replace '["���]', '' + $valueName = $valueName.Matches.Value -replace '[\u201C\u201D]|["���]', '' if ($valueName.Count -gt 1) { diff --git a/StigData/Archive/Office/U_MS_OfficeSystem_2013_STIG_V1R9_Manual-xccdf.log b/StigData/Archive/Office/U_MS_OfficeSystem_2013_STIG_V1R9_Manual-xccdf.log new file mode 100644 index 000000000..095dd747a --- /dev/null +++ b/StigData/Archive/Office/U_MS_OfficeSystem_2013_STIG_V1R9_Manual-xccdf.log @@ -0,0 +1,6 @@ +V-17547::*::HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Ensure = 'Present'; Key = 'HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\Common\Security'; ValueName = '**del.uficontrols'; ValueType = 'String'}HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Ensure = 'Absent'; Key = 'HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\Common\Security'; ValueName = 'uficontrols'; ValueType = 'String'} +V-17617::*::HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Ensure = 'Present'; Key = 'HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\security'; ValueData = "Microsoft Enhanced RSA and AES Cryptographic Provider", "AES 256", "256"; ValueName = 'DefaultEncryption12'; ValueType = 'String'} +V-17619::*::HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Ensure = 'Present'; Key = 'HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\security'; ValueData = "Microsoft Enhanced RSA and AES Cryptographic Provider", "AES 256", "256"; ValueName = 'OpenXMLEncryption'; ValueType = 'String'} +V-17750::*::HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Ensure = 'Present'; Key = 'HKEY_CURRENT_USER\Software\Policies\Microsoft\VBA\Security'; ValueName = '**del.loadcontrolsinforms'; ValueType = 'String'}HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Ensure = 'Absent'; Key = 'HKEY_CURRENT_USER\Software\Policies\Microsoft\VBA\Security'; ValueName = 'loadcontrolsinforms'; ValueType = 'String'} +V-17759::*::HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Ensure = 'Present'; Key = 'HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\internet'; ValueData = 0; ValueName = 'OpenDocumentsReadWriteWhileBrowsing'; ValueType = 'Dword'} +V-40858::*::HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Office\15.0\Common\OfficeUpdate'; ValueData = $null; ValueName = 'EnableAutomaticUpdates'; ValueType = 'Dword'; OrganizationValueTestString = 'this value is set to 1 to enable AutomaticUpdates for Office '}HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate'; ValueData = $null; ValueName = 'WUServer'; ValueType = 'String'; OrganizationValueTestString = 'WindowsUpdate server is specified for this rule '}HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate'; ValueData = $null; ValueName = 'WUStatusServer'; ValueType = 'String'; OrganizationValueTestString = 'WindowsUpdate statistics server is specified for this rule '}HardCodedRule(RegistryRule)@{DscResource = 'RegistryPolicyFile'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU'; ValueData = $null; ValueName = 'UseWUServer'; ValueType = 'Dword'; OrganizationValueTestString = 'this value is set to 1 to enable the use of a WindowsUpdate Server '} diff --git a/StigData/Archive/Office/U_MS_OfficeSystem_2013_STIG_V1R9_Manual-xccdf.xml b/StigData/Archive/Office/U_MS_OfficeSystem_2013_STIG_V1R9_Manual-xccdf.xml new file mode 100644 index 000000000..afb856cb6 --- /dev/null +++ b/StigData/Archive/Office/U_MS_OfficeSystem_2013_STIG_V1R9_Manual-xccdf.xml @@ -0,0 +1,1834 @@ + + + accepted + Microsoft Office System 2013 STIG + The Microsoft Office System 2013 STIG is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the NIST 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil. + + + DISA + STIG.DOD.MIL + + Release: 9 Benchmark Date: 25 Oct 2019 + 1 + + I - Mission Critical Classified + <ProfileDescription></ProfileDescription> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + I - Mission Critical Sensitive + <ProfileDescription></ProfileDescription> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + II - Mission Support Public + <ProfileDescription></ProfileDescription> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + III - Administrative Classified + <ProfileDescription></ProfileDescription> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + III - Administrative Sensitive + <ProfileDescription></ProfileDescription> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + I - Mission Critical Public + <ProfileDescription></ProfileDescription> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + II - Mission Support Classified + <ProfileDescription></ProfileDescription> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + II - Mission Support Sensitive + <ProfileDescription></ProfileDescription> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + III - Administrative Public + <ProfileDescription></ProfileDescription> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + SRG-OS-000028-GPOS-00009 + <GroupDescription></GroupDescription> + + WN19-SO-000120 + Windows Server 2019 machine inactivity limit must be set to 15 minutes or less, locking the system with the screen saver. + <VulnDiscussion>Unattended systems are susceptible to unauthorized use and should be locked when unattended. The screen saver should be set at a maximum of 15 minutes and be password protected. This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer. + +Satisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000056 + CCI-000057 + CCI-000060 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive logon: Machine inactivity limit" to "900" seconds or less, excluding "0" which is effectively disabled. + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: InactivityTimeoutSecs + +Value Type: REG_DWORD +Value: 0x00000384 (900) (or less, excluding "0" which is effectively disabled) + + + + + SRG-OS-000032-GPOS-00013 + <GroupDescription></GroupDescription> + + WN19-AU-000190 + Windows Server 2019 must be configured to audit logon successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed. + +Satisfies: SRG-OS-000032-GPOS-00013, SRG-OS-000470-GPOS-00214, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000475-GPOS-00220</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000067 + CCI-000172 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logon" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Logon - Success + + + + + SRG-OS-000032-GPOS-00013 + <GroupDescription></GroupDescription> + + WN19-AU-000200 + Windows Server 2019 must be configured to audit logon failures. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed. + +Satisfies: SRG-OS-000032-GPOS-00013, SRG-OS-000470-GPOS-00214, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000475-GPOS-00220</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000067 + CCI-000172 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logon" with "Failure" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Logon - Failure + + + + + SRG-OS-000033-GPOS-00014 + <GroupDescription></GroupDescription> + + WN19-CC-000370 + Windows Server 2019 Remote Desktop Services must require secure Remote Procedure Call (RPC) communications. + <VulnDiscussion>Allowing unsecure RPC communication exposes the system to man-in-the-middle attacks and data disclosure attacks. A man-in-the-middle attack occurs when an intruder captures packets between a client and server and modifies them before allowing the packets to be exchanged. Usually the attacker will modify the information in the packets in an attempt to cause either the client or server to reveal sensitive information. + +Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000250-GPOS-00093</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000068 + CCI-001453 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> "Require secure RPC communication" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fEncryptRPCTraffic + +Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000033-GPOS-00014 + <GroupDescription></GroupDescription> + + WN19-CC-000380 + Windows Server 2019 Remote Desktop Services must be configured with the client connection encryption set to High Level. + <VulnDiscussion>Remote connections must be encrypted to prevent interception of data or sensitive information. Selecting "High Level" will ensure encryption of Remote Desktop Services sessions in both directions. + +Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000250-GPOS-00093</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000068 + CCI-001453 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> "Set client connection encryption level" to "Enabled" with "High Level" selected. + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: MinEncryptionLevel + +Type: REG_DWORD +Value: 0x00000003 (3) + + + + + SRG-OS-000002-GPOS-00002 + <GroupDescription></GroupDescription> + + WN19-00-000300 + Windows Server 2019 must automatically remove or disable temporary user accounts after 72 hours. + <VulnDiscussion>If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation. + +Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. + +If temporary accounts are used, the operating system must be configured to automatically terminate these types of accounts after a DoD-defined time period of 72 hours. + +To address access requirements, many operating systems may be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000016 + Configure temporary user accounts to automatically expire within 72 hours. + +Domain accounts can be configured with an account expiration date, under "Account" properties. + +Local accounts can be configured to expire with the command "Net user [username] /expires:[mm/dd/yyyy]", where username is the name of the temporary user account. + +Delete any temporary user accounts that are no longer necessary. + + + + Review temporary user accounts for expiration dates. + +Determine if temporary user accounts are used and identify any that exist. If none exist, this is NA. + +Domain Controllers: + +Open "PowerShell". + +Enter "Search-ADAccount -AccountExpiring | FT Name, AccountExpirationDate". + +If "AccountExpirationDate" has not been defined within 72 hours for any temporary user account, this is a finding. + +Member servers and standalone systems: + +Open "Command Prompt". + +Run "Net user [username]", where [username] is the name of the temporary user account. + +If "Account expires" has not been defined within 72 hours for any temporary user account, this is a finding. + + + + + SRG-OS-000123-GPOS-00064 + <GroupDescription></GroupDescription> + + WN19-00-000310 + Windows Server 2019 must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours. + <VulnDiscussion>Emergency administrator accounts are privileged accounts established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability. + +Emergency administrator accounts are different from infrequently used accounts (i.e., local logon accounts used by system administrators when network or normal logon/access is not available). Infrequently used accounts are not subject to automatic termination dates. Emergency accounts are accounts created in response to crisis situations, usually for use by maintenance personnel. The automatic expiration or disabling time period may be extended as needed until the crisis is resolved; however, it must not be extended indefinitely. A permanent account should be established for privileged users who need long-term maintenance accounts. + +To address access requirements, many operating systems can be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001682 + Remove emergency administrator accounts after a crisis has been resolved or configure the accounts to automatically expire within 72 hours. + +Domain accounts can be configured with an account expiration date, under "Account" properties. + +Local accounts can be configured to expire with the command "Net user [username] /expires:[mm/dd/yyyy]", where username is the name of the temporary user account. + + + + Determine if emergency administrator accounts are used and identify any that exist. If none exist, this is NA. + +If emergency administrator accounts cannot be configured with an expiration date due to an ongoing crisis, the accounts must be disabled or removed when the crisis is resolved. + +If emergency administrator accounts have not been configured with an expiration date or have not been disabled or removed following the resolution of a crisis, this is a finding. + +Domain Controllers: + +Open "PowerShell". + +Enter "Search-ADAccount -AccountExpiring | FT Name, AccountExpirationDate". + +If "AccountExpirationDate" has been defined and is not within 72 hours for an emergency administrator account, this is a finding. + +Member servers and standalone systems: + +Open "Command Prompt". + +Run "Net user [username]", where [username] is the name of the emergency account. + +If "Account expires" has been defined and is not within 72 hours for an emergency administrator account, this is a finding. + + + + + SRG-OS-000004-GPOS-00004 + <GroupDescription></GroupDescription> + + WN19-AU-000100 + Windows Server 2019 must be configured to audit Account Management - Security Group Management successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Security Group Management records events such as creating, deleting, or changing security groups, including changes in group members. + +Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000018 + CCI-000172 + CCI-001403 + CCI-001404 + CCI-001405 + CCI-002130 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Security Group Management" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Management >> Security Group Management - Success + + + + + SRG-OS-000004-GPOS-00004 + <GroupDescription></GroupDescription> + + WN19-AU-000110 + Windows Server 2019 must be configured to audit Account Management - User Account Management successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts. + +Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000018 + CCI-000172 + CCI-001403 + CCI-001404 + CCI-001405 + CCI-002130 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit User Account Management" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Management >> User Account Management - Success + + + + + SRG-OS-000004-GPOS-00004 + <GroupDescription></GroupDescription> + + WN19-AU-000120 + Windows Server 2019 must be configured to audit Account Management - User Account Management failures. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts. + +Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000018 + CCI-000172 + CCI-001403 + CCI-001404 + CCI-001405 + CCI-002130 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit User Account Management" with "Failure" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Management >> User Account Management - Failure + + + + + SRG-OS-000004-GPOS-00004 + <GroupDescription></GroupDescription> + + WN19-DC-000230 + Windows Server 2019 must be configured to audit Account Management - Computer Account Management successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Computer Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling computer accounts. + +Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000018 + CCI-000172 + CCI-001403 + CCI-001404 + CCI-001405 + CCI-002130 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Computer Account Management" with "Success" selected. + + + + This applies to domain controllers. It is NA for other systems. + +Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Management >> Computer Account Management - Success + + + + + SRG-OS-000240-GPOS-00090 + <GroupDescription></GroupDescription> + + WN19-AU-000150 + Windows Server 2019 must be configured to audit Logon/Logoff - Account Lockout successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Account Lockout events can be used to identify potentially malicious logon attempts. + +Satisfies: SRG-OS-000240-GPOS-00090, SRG-OS-000470-GPOS-00214</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-001404 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Account Lockout - Success + + + + + SRG-OS-000240-GPOS-00090 + <GroupDescription></GroupDescription> + + WN19-AU-000160 + Windows Server 2019 must be configured to audit Logon/Logoff - Account Lockout failures. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Account Lockout events can be used to identify potentially malicious logon attempts. + +Satisfies: SRG-OS-000240-GPOS-00090, SRG-OS-000470-GPOS-00214</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-001404 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" with "Failure" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Account Lockout - Failure + + + + + SRG-OS-000080-GPOS-00048 + <GroupDescription></GroupDescription> + + WN19-00-000130 + Windows Server 2019 local volumes must use a format that supports NTFS attributes. + <VulnDiscussion>The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system. To support this, volumes must be formatted using a file system that supports NTFS attributes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000213 + Format volumes to use NTFS or ReFS. + + + + Open "Computer Management". + +Select "Disk Management" under "Storage". + +For each local volume, if the file system does not indicate "NTFS", this is a finding. + +"ReFS" (resilient file system) is also acceptable and would not be a finding. + +This does not apply to system partitions such the Recovery and EFI System Partition. + + + + + SRG-OS-000080-GPOS-00048 + <GroupDescription></GroupDescription> + + WN19-00-000180 + Windows Server 2019 non-administrative accounts or groups must only have print permissions on printer shares. + <VulnDiscussion>Windows shares are a means by which files, folders, printers, and other resources can be published for network users to access. Improper configuration can permit access to devices and data beyond a user's need.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000213 + Configure the permissions on shared printers to restrict standard users to only have Print permissions. + + + + Open "Printers & scanners" in "Settings". + +If there are no printers configured, this is NA. (Exclude Microsoft Print to PDF and Microsoft XPS Document Writer, which do not support sharing.) + +For each printer: + +Select the printer and "Manage". + +Select "Printer Properties". + +Select the "Sharing" tab. + +If "Share this printer" is checked, select the "Security" tab. + +If any standard user accounts or groups have permissions other than "Print", this is a finding. + +The default is for the "Everyone" group to be given "Print" permission. + +"All APPLICATION PACKAGES" and "CREATOR OWNER" are not standard user accounts. + + + + + SRG-OS-000312-GPOS-00122 + <GroupDescription></GroupDescription> + + WN19-00-000140 + Windows Server 2019 permissions for the system drive root directory (usually C:\) must conform to minimum requirements. + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + +The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002165 + Maintain the default permissions for the system drive's root directory and configure the Security Option "Network access: Let Everyone permissions apply to anonymous users" to "Disabled" (WN19-SO-000240). + +Default Permissions +C:\ +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +SYSTEM - Full control - This folder, subfolders, and files +Administrators - Full control - This folder, subfolders, and files +Users - Read & execute - This folder, subfolders, and files +Users - Create folders/append data - This folder and subfolders +Users - Create files/write data - Subfolders only +CREATOR OWNER - Full Control - Subfolders and files only + + + + The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Review the permissions for the system drive's root directory (usually C:\). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions except where noted as defaults. Individual accounts must not be used to assign permissions. + +If permissions are not as restrictive as the default permissions listed below, this is a finding. + +Viewing in File Explorer: + +View the Properties of the system drive's root directory. + +Select the "Security" tab, and the "Advanced" button. + +Default permissions: +C:\ +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +SYSTEM - Full control - This folder, subfolders, and files +Administrators - Full control - This folder, subfolders, and files +Users - Read & execute - This folder, subfolders, and files +Users - Create folders/append data - This folder and subfolders +Users - Create files/write data - Subfolders only +CREATOR OWNER - Full Control - Subfolders and files only + +Alternately, use icacls: + +Open "Command Prompt (Admin)". + +Enter "icacls" followed by the directory: + +"icacls c:\" + +The following results should be displayed: + +c:\ +NT AUTHORITY\SYSTEM:(OI)(CI)(F) +BUILTIN\Administrators:(OI)(CI)(F) +BUILTIN\Users:(OI)(CI)(RX) +BUILTIN\Users:(CI)(AD) +BUILTIN\Users:(CI)(IO)(WD) +CREATOR OWNER:(OI)(CI)(IO)(F) +Successfully processed 1 files; Failed processing 0 files + + + + + SRG-OS-000312-GPOS-00122 + <GroupDescription></GroupDescription> + + WN19-00-000150 + Windows Server 2019 permissions for program file directories must conform to minimum requirements. + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + +The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002165 + Maintain the default permissions for the program file directories and configure the Security Option "Network access: Let Everyone permissions apply to anonymous users" to "Disabled" (WN19-SO-000240). + +Default permissions: +\Program Files and \Program Files (x86) +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders, and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files + + + + The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Review the permissions for the program file directories (Program Files and Program Files [x86]). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. Individual accounts must not be used to assign permissions. + +If permissions are not as restrictive as the default permissions listed below, this is a finding. + +Viewing in File Explorer: + +For each folder, view the Properties. + +Select the "Security" tab, and the "Advanced" button. + +Default permissions: +\Program Files and \Program Files (x86) +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files + +Alternately, use icacls: + +Open a Command prompt (admin). + +Enter "icacls" followed by the directory: + +'icacls "c:\program files"' +'icacls "c:\program files (x86)"' + +The following results should be displayed for each when entered: + +c:\program files (c:\program files (x86)) +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 files + + + + + SRG-OS-000312-GPOS-00122 + <GroupDescription></GroupDescription> + + WN19-00-000160 + Windows Server 2019 permissions for the Windows installation directory must conform to minimum requirements. + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + +The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002165 + Maintain the default file ACLs and configure the Security Option "Network access: Let Everyone permissions apply to anonymous users" to "Disabled" (WN19-SO-000240). + +Default permissions: +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders, and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files + + + + The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Review the permissions for the Windows installation directory (usually C:\Windows). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. Individual accounts must not be used to assign permissions. + +If permissions are not as restrictive as the default permissions listed below, this is a finding: + +Viewing in File Explorer: + +For each folder, view the Properties. + +Select the "Security" tab and the "Advanced" button. + +Default permissions: +\Windows +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders, and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files + +Alternately, use icacls: + +Open a Command prompt (admin). + +Enter "icacls" followed by the directory: + +"icacls c:\windows" + +The following results should be displayed for each when entered: + +c:\windows +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 files + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-00-000170 + Windows Server 2019 default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained. + <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Maintain the default permissions for the HKEY_LOCAL_MACHINE registry hive. + +The default permissions of the higher-level keys are noted below. + +HKEY_LOCAL_MACHINE\SECURITY + +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +SYSTEM - Full Control - This key and subkeys +Administrators - Special - This key and subkeys + +HKEY_LOCAL_MACHINE\SOFTWARE + +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +Users - Read - This key and subkeys +Administrators - Full Control - This key and subkeys +SYSTEM - Full Control - This key and subkeys +CREATOR OWNER - Full Control - This key and subkeys +ALL APPLICATION PACKAGES - Read - This key and subkeys + +HKEY_LOCAL_MACHINE\SYSTEM + +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +Users - Read - This key and subkeys +Administrators - Full Control - This key and subkeys +SYSTEM - Full Control - This key and subkeys +CREATOR OWNER - Full Control - Subkeys only +ALL APPLICATION PACKAGES - Read - This key and subkeys + +Microsoft has also given Read permission to the SOFTWARE and SYSTEM registry keys in Windows Server 2019 to the following SID. +S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681 + + + + Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. + +If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. + +If permissions are not as restrictive as the default permissions listed below, this is a finding: + +Run "Regedit". + +Right-click on the registry areas noted below. + +Select "Permissions" and the "Advanced" button. + +HKEY_LOCAL_MACHINE\SECURITY + +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +SYSTEM - Full Control - This key and subkeys +Administrators - Special - This key and subkeys + +HKEY_LOCAL_MACHINE\SOFTWARE + +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +Users - Read - This key and subkeys +Administrators - Full Control - This key and subkeys +SYSTEM - Full Control - This key and subkeys +CREATOR OWNER - Full Control - This key and subkeys +ALL APPLICATION PACKAGES - Read - This key and subkeys + +HKEY_LOCAL_MACHINE\SYSTEM + +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +Users - Read - This key and subkeys +Administrators - Full Control - This key and subkeys +SYSTEM - Full Control - This key and subkeys +CREATOR OWNER - Full Control - Subkeys only +ALL APPLICATION PACKAGES - Read - This key and subkeys + +Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. + +Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in Windows Server 2019 to the following SID, this is currently not a finding. +S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681 + +If the defaults have not been changed, these are not a finding. + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-DC-000010 + Windows Server 2019 must only allow administrators responsible for the domain controller to have Administrator rights on the system. + <VulnDiscussion>An account that does not have Administrator duties must not have Administrator rights. Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack. + +System administrators must log on to systems using only accounts with the minimum level of authority necessary. + +Standard user accounts must not be members of the built-in Administrators group.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the Administrators group to include only administrator groups or accounts that are responsible for the system. + +Remove any standard user accounts. + + + + This applies to domain controllers. A separate version applies to other systems. + +Review the Administrators group. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group. + +Standard user accounts must not be members of the local administrator group. + +If prohibited accounts are members of the local administrators group, this is a finding. + +If the built-in Administrator account or other required administrative accounts are found on the system, this is not a finding. + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-DC-000070 + Windows Server 2019 permissions on the Active Directory data files must only allow System and Administrators access. + <VulnDiscussion>Improper access permissions for directory data-related files could allow unauthorized users to read, modify, or delete directory data or audit trails.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Maintain the permissions on NTDS database and log files as follows: + +NT AUTHORITY\SYSTEM:(I)(F) +BUILTIN\Administrators:(I)(F) + +(I) - permission inherited from parent container +(F) - full access + + + + This applies to domain controllers. It is NA for other systems. + +Run "Regedit". + +Navigate to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters". + +Note the directory locations in the values for: + +Database log files path +DSA Database file + +By default, they will be \Windows\NTDS. + +If the locations are different, the following will need to be run for each. + +Open "Command Prompt (Admin)". + +Navigate to the NTDS directory (\Windows\NTDS by default). + +Run "icacls *.*". + +If the permissions on each file are not as restrictive as the following, this is a finding: + +NT AUTHORITY\SYSTEM:(I)(F) +BUILTIN\Administrators:(I)(F) + +(I) - permission inherited from parent container +(F) - full access + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-DC-000080 + Windows Server 2019 Active Directory SYSVOL directory must have the proper access control permissions. + <VulnDiscussion>Improper access permissions for directory data files could allow unauthorized users to read, modify, or delete directory data. + +The SYSVOL directory contains public files (to the domain) such as policies and logon scripts. Data in shared subdirectories are replicated to all domain controllers in a domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Maintain the permissions on the SYSVOL directory. Do not allow greater than "Read & execute" permissions for standard user accounts or groups. The defaults below meet this requirement: + +C:\Windows\SYSVOL +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +Authenticated Users - Read & execute - This folder, subfolder, and files +Server Operators - Read & execute- This folder, subfolder, and files +Administrators - Special - This folder only (Special = Basic Permissions: all selected except Full control) +CREATOR OWNER - Full control - Subfolders and files only +Administrators - Full control - Subfolders and files only +SYSTEM - Full control - This folder, subfolders, and files + + + + This applies to domain controllers. It is NA for other systems. + +Open a command prompt. + +Run "net share". + +Make note of the directory location of the SYSVOL share. + +By default, this will be \Windows\SYSVOL\sysvol. For this requirement, permissions will be verified at the first SYSVOL directory level. + +If any standard user accounts or groups have greater than "Read & execute" permissions, this is a finding. + +The default permissions noted below meet this requirement: + +Open "Command Prompt". + +Run "icacls c:\Windows\SYSVOL". + +The following results should be displayed: + +NT AUTHORITY\Authenticated Users:(RX) +NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(GR,GE) +BUILTIN\Server Operators:(RX) +BUILTIN\Server Operators:(OI)(CI)(IO)(GR,GE) +BUILTIN\Administrators:(M,WDAC,WO) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(F) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +CREATOR OWNER:(OI)(CI)(IO)(F) + +(RX) - Read & execute + +Run "icacls /help" to view definitions of other permission codes. + +Alternately, open "File Explorer". + +Navigate to \Windows\SYSVOL (or the directory noted previously if different). + +Right-click the directory and select properties. + +Select the "Security" tab and click "Advanced". + +Default permissions: + +C:\Windows\SYSVOL +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +Authenticated Users - Read & execute - This folder, subfolder, and files +Server Operators - Read & execute- This folder, subfolder, and files +Administrators - Special - This folder only (Special = Basic Permissions: all selected except Full control) +CREATOR OWNER - Full control - Subfolders and files only +Administrators - Full control - Subfolders and files only +SYSTEM - Full control - This folder, subfolders, and files + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-DC-000090 + Windows Server 2019 Active Directory Group Policy objects must have proper access control permissions. + <VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems relying on the directory service. + +For Active Directory (AD), the Group Policy objects require special attention. In a distributed administration model (i.e., help desk), Group Policy objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for Group Policy objects, this could allow an intruder to change the security policy applied to all domain client computers (workstations and servers).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Maintain the permissions on Group Policy objects to not allow greater than "Read" and "Apply group policy" for standard user accounts or groups. The default permissions below meet this requirement: + +Authenticated Users - Read, Apply group policy, Special permissions + +The special permissions for Authenticated Users are for Read-type Properties. + +CREATOR OWNER - Special permissions +SYSTEM - Read, Write, Create all child objects, Delete all child objects, Special permissions +Domain Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions +Enterprise Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + +Document any other access permissions that allow the objects to be updated with the ISSO. + +The Domain Admins and Enterprise Admins will not have the "Delete all child objects" permission on the two default Group Policy objects: Default Domain Policy and Default Domain Controllers Policy. They will have this permission on created Group Policy objects. + + + + This applies to domain controllers. It is NA for other systems. + +Review the permissions on Group Policy objects. + +Open "Group Policy Management" (available from various menus or run "gpmc.msc"). + +Navigate to "Group Policy Objects" in the domain being reviewed (Forest >> Domains >> Domain). + +For each Group Policy object: + +Select the Group Policy object item in the left pane. + +Select the "Delegation" tab in the right pane. + +Select the "Advanced" button. + +Select each Group or user name. + +View the permissions. + +If any standard user accounts or groups have "Allow" permissions greater than "Read" and "Apply group policy", this is a finding. + +Other access permissions that allow the objects to be updated are considered findings unless specifically documented by the ISSO. + +The default permissions noted below satisfy this requirement. + +The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the next "Advanced" button, the desired Permission entry, and the "Edit" button. + +Authenticated Users - Read, Apply group policy, Special permissions + +The special permissions for Authenticated Users are for Read-type Properties. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +The special permissions for the following default groups are not the focus of this requirement and may include a wide range of permissions and properties: + +CREATOR OWNER - Special permissions +SYSTEM - Read, Write, Create all child objects, Delete all child objects, Special permissions +Domain Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions +Enterprise Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + +The Domain Admins and Enterprise Admins will not have the "Delete all child objects" permission on the two default Group Policy objects: Default Domain Policy and Default Domain Controllers Policy. They will have this permission on organization created Group Policy objects. + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-DC-000100 + Windows Server 2019 Active Directory Domain Controllers Organizational Unit (OU) object must have the proper access control permissions. + <VulnDiscussion>When Active Directory objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. + +The Domain Controllers OU object requires special attention as the Domain Controllers are central to the configuration and management of the domain. Inappropriate access permissions defined for the Domain Controllers OU could allow an intruder or unauthorized personnel to make changes that could lead to the compromise of the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Limit the permissions on the Domain Controllers OU to restrict changes to System, Domain Admins, Enterprise Admins and Administrators. + +The default permissions listed below satisfy this requirement. + +Domains supporting Microsoft Exchange will have additional Exchange related permissions on the Domain Controllers OU. These may include some change related permissions. + +CREATOR OWNER - Special permissions + +SELF - Special permissions + +Authenticated Users - Read, Special permissions + +The special permissions for Authenticated Users are Read types. + +SYSTEM - Full Control + +Domain Admins - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Enterprise Admins - Full Control + +Key Admins - Special permissions + +Enterprise Key Admins - Special permissions + +Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Pre-Windows 2000 Compatible Access - Special permissions + +The special permissions for Pre-Windows 2000 Compatible Access are Read types. + +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + + + + This applies to domain controllers. It is NA for other systems. + +Review the permissions on the Domain Controllers OU. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Select "Advanced Features" in the "View" menu if not previously selected. + +Select the "Domain Controllers" OU (folder in folder icon). + +Right-click and select "Properties". + +Select the "Security" tab. + +If the permissions on the Domain Controllers OU do not restrict changes to System, Domain Admins, Enterprise Admins and Administrators, this is a finding. + +The default permissions listed below satisfy this requirement. + +Domains supporting Microsoft Exchange will have additional Exchange related permissions on the Domain Controllers OU. These may include some change related permissions and are not a finding. + +The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "View" or "Edit" button. + +Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. + +CREATOR OWNER - Special permissions + +SELF - Special permissions + +Authenticated Users - Read, Special permissions + +The special permissions for Authenticated Users are Read types. + +If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +SYSTEM - Full Control + +Domain Admins - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Enterprise Admins - Full Control + +Key Admins - Special permissions + +Enterprise Key Admins - Special permissions + +Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Pre-Windows 2000 Compatible Access - Special permissions + +The Special permissions for Pre-Windows 2000 Compatible Access are Read types. + +If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-DC-000110 + Windows Server 2019 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. + <VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. + +For Active Directory, the OU objects require special attention. In a distributed administration model (i.e., help desk), OU objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for OU objects, it could allow an intruder to add or delete users in the OU. This could result in unauthorized access to data or a denial of service (DoS) to authorized users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Maintain the Allow type permissions on domain-defined OUs to be at least as restrictive as the defaults below. + +Document any additional permissions above Read with the ISSO if an approved distributed administration model (help desk or other user support staff) is implemented. + +CREATOR OWNER - Special permissions + +Self - Special permissions + +Authenticated Users - Read, Special permissions + +The special permissions for Authenticated Users are Read type. + +SYSTEM - Full Control + +Domain Admins - Full Control + +Enterprise Admins - Full Control + +Key Admins - Special permissions + +Enterprise Key Admins - Special permissions + +Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Pre-Windows 2000 Compatible Access - Special permissions + +The special permissions for Pre-Windows 2000 Compatible Access are for Read types. + +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + + + + This applies to domain controllers. It is NA for other systems. + +Review the permissions on domain-defined OUs. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +For each OU that is defined (folder in folder icon) excluding the Domain Controllers OU: + +Right-click the OU and select "Properties". + +Select the "Security" tab. + +If the Allow type permissions on the OU are not at least as restrictive as those below, this is a finding. + +The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "Edit" or "View" button. + +Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. + +CREATOR OWNER - Special permissions + +Self - Special permissions + +Authenticated Users - Read, Special permissions + +The Special permissions for Authenticated Users are Read type. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +SYSTEM - Full Control + +Domain Admins - Full Control + +Enterprise Admins - Full Control + +Key Admins - Special permissions + +Enterprise Key Admins - Special permissions + +Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Pre-Windows 2000 Compatible Access - Special permissions + +The Special permissions for Pre-Windows 2000 Compatible Access are for Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + +If an ISSO-approved distributed administration model (help desk or other user support staff) is implemented, permissions above Read may be allowed for groups documented by the ISSO. + +If any OU with improper permissions includes identification or authentication data (e.g., accounts, passwords, or password hash data) used by systems to determine access control, the severity is CAT I (e.g., OUs that include user accounts, including service/application accounts). + +If an OU with improper permissions does not include identification and authentication data used by systems to determine access control, the severity is CAT II (e.g., Workstation, Printer OUs). + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-AU-000090 + Windows Server 2019 must be configured to audit Account Management - Other Account Management Events successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Other Account Management Events records events such as the access of a password hash or the Password Policy Checking API being called. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Other Account Management Events" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding: + +Account Management >> Other Account Management Events - Success + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-AU-000140 + Windows Server 2019 must be configured to audit Detailed Tracking - Process Creation successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Process Creation records events related to the creation of a process and the source. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000471-GPOS-00215</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> "Audit Process Creation" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Detailed Tracking >> Process Creation - Success + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-AU-000260 + Windows Server 2019 must be configured to audit Policy Change - Audit Policy Change successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Policy Change records events related to changes in audit policy. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Audit Policy Change" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Policy Change >> Audit Policy Change - Success + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-AU-000270 + Windows Server 2019 must be configured to audit Policy Change - Audit Policy Change failures. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Policy Change records events related to changes in audit policy. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Audit Policy Change" with "Failure" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Policy Change >> Audit Policy Change - Failure + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-AU-000280 + Windows Server 2019 must be configured to audit Policy Change - Authentication Policy Change successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Authentication Policy Change records events related to changes in authentication policy, including Kerberos policy and Trust changes. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Authentication Policy Change" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Policy Change >> Authentication Policy Change - Success + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-AU-000290 + Windows Server 2019 must be configured to audit Policy Change - Authorization Policy Change successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Authorization Policy Change records events related to changes in user rights, such as "Create a token object". + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Authorization Policy Change" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Policy Change >> Authorization Policy Change - Success + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-AU-000300 + Windows Server 2019 must be configured to audit Privilege Use - Sensitive Privilege Use successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs". + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> "Audit Sensitive Privilege Use" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Privilege Use >> Sensitive Privilege Use - Success + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-AU-000310 + Windows Server 2019 must be configured to audit Privilege Use - Sensitive Privilege Use failures. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs". + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> "Audit Sensitive Privilege Use" with "Failure" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Privilege Use >> Sensitive Privilege Use - Failure + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-AU-000320 + Windows Server 2019 must be configured to audit System - IPsec Driver successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +IPsec Driver records events related to the IPsec Driver, such as dropped packets. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit IPsec Driver" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> IPsec Driver - Success + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-AU-000330 + Windows Server 2019 must be configured to audit System - IPsec Driver failures. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +IPsec Driver records events related to the IPsec Driver, such as dropped packets. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit IPsec Driver" with "Failure" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> IPsec Driver - Failure + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-AU-000340 + Windows Server 2019 must be configured to audit System - Other System Events successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Other System Events" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> Other System Events - Success + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-AU-000350 + Windows Server 2019 must be configured to audit System - Other System Events failures. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Other System Events" with "Failure" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> Other System Events - Failure + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-AU-000360 + Windows Server 2019 must be configured to audit System - Security State Change successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Security State Change records events related to changes in the security state, such as startup and shutdown of the system. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Security State Change" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> Security State Change - Success + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-AU-000370 + Windows Server 2019 must be configured to audit System - Security System Extension successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Security System Extension records events related to extension code being loaded by the security subsystem. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Security System Extension" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> Security System Extension - Success + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-AU-000380 + Windows Server 2019 must be configured to audit System - System Integrity successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +System Integrity records events related to violations of integrity to the security subsystem. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit System Integrity" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> System Integrity - Success + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-AU-000390 + Windows Server 2019 must be configured to audit System - System Integrity failures. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +System Integrity records events related to violations of integrity to the security subsystem. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit System Integrity" with "Failure" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> System Integrity - Failure + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-DC-000170 + Windows Server 2019 Active Directory Group Policy objects must be configured with proper audit settings. + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes Group Policy objects. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the audit settings for Group Policy objects to include the following: + +This can be done at the Policy level in Active Directory to apply to all group policies. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Select "Advanced Features" from the "View" Menu. + +Navigate to [Domain] >> System >> Policies in the left panel. + +Right click "Policies", select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button. + +Select the "Auditing" tab. + +Type - Fail +Principal - Everyone +Access - Full Control +Applies to - This object and all descendant objects or Descendant groupPolicyContainer objects + +The three Success types listed below are defaults inherited from the Parent Object. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. + +Type - Success +Principal - Everyone +Access - Special (Permissions: Write all properties, Modify permissions; Properties: all "Write" type selected) +Inherited from - Parent Object +Applies to - Descendant groupPolicyContainer objects + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions) +Inherited from - Parent Object +Applies to - Descendant Organization Unit Objects + + + + This applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for all Group Policy objects. + +Open "Group Policy Management" (available from various menus or run "gpmc.msc"). + +Navigate to "Group Policy Objects" in the domain being reviewed (Forest >> Domains >> Domain). + +For each Group Policy object: + +Select the Group Policy object item in the left pane. + +Select the "Delegation" tab in the right pane. + +Select the "Advanced" button. + +Select the "Advanced" button again and then the "Auditing" tab. + +If the audit settings for any Group Policy object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Applies to - This object and all descendant objects or Descendant groupPolicyContainer objects + +The three Success types listed below are defaults inherited from the Parent Object. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. + +Type - Success +Principal - Everyone +Access - Special (Permissions: Write all properties, Modify permissions; Properties: all "Write" type selected) +Inherited from - Parent Object +Applies to - Descendant groupPolicyContainer objects + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions) +Inherited from - Parent Object +Applies to - Descendant Organization Unit Objects + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-DC-000180 + Windows Server 2019 Active Directory Domain object must be configured with proper audit settings. + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select the domain being reviewed in the left pane. + +Right-click the domain name and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +Configure the audit settings for Domain object to include the following: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - None +Applies to - Special + +Type - Success +Principal - Domain Users +Access - All extended rights +Inherited from - None +Applies to - This object only + +Type - Success +Principal - Administrators +Access - All extended rights +Inherited from - None +Applies to - This object only + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner.) + + + + This applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for the Domain object. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select the domain being reviewed in the left pane. + +Right-click the domain name and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +If the audit settings on the Domain object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - None +Applies to - Special + +Type - Success +Principal - Domain Users +Access - All extended rights +Inherited from - None +Applies to - This object only + +Type - Success +Principal - Administrators +Access - All extended rights +Inherited from - None +Applies to - This object only + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner) + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-DC-000190 + Windows Server 2019 Active Directory Infrastructure object must be configured with proper audit settings. + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Infrastructure object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select the domain being reviewed in the left pane. + +Right-click the "Infrastructure" object in the right pane and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +Configure the audit settings for Infrastructure object to include the following: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master) + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) + + + + This applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for Infrastructure object. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select the domain being reviewed in the left pane. + +Right-click the "Infrastructure" object in the right pane and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +If the audit settings on the Infrastructure object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master) + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-DC-000200 + Windows Server 2019 Active Directory Domain Controllers Organizational Unit (OU) object must be configured with proper audit settings. + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain Controller OU object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select the "Domain Controllers OU" under the domain being reviewed in the left pane. + +Right-click the "Domain Controllers OU" object and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +Configure the audit settings for Domain Controllers OU object to include the following: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: all create, delete and modify permissions) + +Type - Success +Principal - Everyone +Access - Write all properties +Inherited from - None +Applies to - This object and all descendant objects + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objects + + + + This applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for the Domain Controller OU object. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select the "Domain Controllers OU" under the domain being reviewed in the left pane. + +Right-click the "Domain Controllers OU" object and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +If the audit settings on the Domain Controllers OU object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object and all descendant objects + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: all create, delete and modify permissions) + +Type - Success +Principal - Everyone +Access - Write all properties +Inherited from - None +Applies to - This object and all descendant objects + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objects + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-DC-000210 + Windows Server 2019 Active Directory AdminSDHolder object must be configured with proper audit settings. + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the AdminSDHolder object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select "System" under the domain being reviewed in the left pane. + +Right-click the "AdminSDHolder" object in the right pane and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +Configure the audit settings for AdminSDHolder object to include the following: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Write all properties, Modify permissions, Modify owner) + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objects + + + + This applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for the "AdminSDHolder" object. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select "System" under the domain being reviewed in the left pane. + +Right-click the "AdminSDHolder" object in the right pane and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +If the audit settings on the "AdminSDHolder" object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Write all properties, Modify permissions, Modify owner) + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objects + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-DC-000220 + Windows Server 2019 Active Directory RID Manager$ object must be configured with proper audit settings. + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the RID Manager$ object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select "System" under the domain being reviewed in the left pane. + +Right-click the "RID Manager$" object in the right pane and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +Configure the audit settings for RID Manager$ object to include the following: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None + (Access - Special = Write all properties, All extended rights, Change RID master) + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) + + + + This applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for the "RID Manager$" object. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select "System" under the domain being reviewed in the left pane. + +Right-click the "RID Manager$" object in the right pane and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +If the audit settings on the "RID Manager$" object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None + (Access - Special = Write all properties, All extended rights, Change RID master) + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-DC-000240 + Windows Server 2019 must be configured to audit DS Access - Directory Service Access successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Directory Service Access records events related to users accessing an Active Directory object. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> DS Access >> "Directory Service Access" with "Success" selected. + + + + This applies to domain controllers. It is NA for other systems. + +Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +DS Access >> Directory Service Access - Success + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-DC-000250 + Windows Server 2019 must be configured to audit DS Access - Directory Service Access failures. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Directory Service Access records events related to users accessing an Active Directory object. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> DS Access >> "Directory Service Access" with "Failure" selected. + + + + This applies to domain controllers. It is NA for other systems. + +Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +DS Access >> Directory Service Access - Failure + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-DC-000260 + Windows Server 2019 must be configured to audit DS Access - Directory Service Changes successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Directory Service Changes records events related to changes made to objects in Active Directory Domain Services. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> DS Access >> "Directory Service Changes" with "Success" selected. + + + + This applies to domain controllers. It is NA for other systems. + +Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +DS Access >> Directory Service Changes - Success + + + + + SRG-OS-000327-GPOS-00127 + <GroupDescription></GroupDescription> + + WN19-DC-000270 + Windows Server 2019 must be configured to audit DS Access - Directory Service Changes failures. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Directory Service Changes records events related to changes made to objects in Active Directory Domain Services. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-002234 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> DS Access >> "Directory Service Changes" with "Failure" selected. + + + + This applies to domain controllers. It is NA for other systems. + +Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +DS Access >> Directory Service Changes - Failure + + + + + SRG-OS-000023-GPOS-00006 + <GroupDescription></GroupDescription> + + WN19-SO-000130 + Windows Server 2019 required legal notice must be configured to display before console logon. + <VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. + +Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000048 + CCI-000050 + CCI-001384 + CCI-001385 + CCI-001386 + CCI-001387 + CCI-001388 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive Logon: Message text for users attempting to log on" to the following: + +You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. + +By using this IS (which includes any device attached to this IS), you consent to the following conditions: + +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. + +-At any time, the USG may inspect and seize data stored on this IS. + +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. + +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. + +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: LegalNoticeText + +Value Type: REG_SZ +Value: See message text below + +You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. + +By using this IS (which includes any device attached to this IS), you consent to the following conditions: + +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. + +-At any time, the USG may inspect and seize data stored on this IS. + +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. + +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. + +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. + + + + + SRG-OS-000023-GPOS-00006 + <GroupDescription></GroupDescription> + + WN19-SO-000140 + Windows Server 2019 title for legal banner dialog box must be configured with the appropriate text. + <VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. + +Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000048 + CCI-001384 + CCI-001385 + CCI-001386 + CCI-001387 + CCI-001388 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive Logon: Message title for users attempting to log on" to "DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or an organization-defined equivalent. + +If an organization-defined title is used, it can in no case contravene or modify the language of the message text required in WN19-SO-000150. + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: LegalNoticeCaption + +Value Type: REG_SZ +Value: See message title options below + +"DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or an organization-defined equivalent. + +If an organization-defined title is used, it can in no case contravene or modify the language of the banner text required in WN19-SO-000150. + +Automated tools may only search for the titles defined above. If an organization-defined title is used, a manual review will be required. + + + + + SRG-OS-000062-GPOS-00031 + <GroupDescription></GroupDescription> + + WN19-SO-000050 + Windows Server 2019 must force audit policy subcategory settings to override audit policy category settings. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. +This setting allows administrators to enable more precise auditing capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000169 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: SCENoApplyLegacyAuditPolicy + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000470-GPOS-00214 + <GroupDescription></GroupDescription> + + WN19-AU-000070 + Windows Server 2019 must be configured to audit Account Logon - Credential Validation successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Credential Validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> "Audit Credential Validation" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Logon >> Credential Validation - Success + + + + + SRG-OS-000470-GPOS-00214 + <GroupDescription></GroupDescription> + + WN19-AU-000080 + Windows Server 2019 must be configured to audit Account Logon - Credential Validation failures. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Credential Validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> "Audit Credential Validation" with "Failure" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Logon >> Credential Validation - Failure + + + + + SRG-OS-000474-GPOS-00219 + <GroupDescription></GroupDescription> + + WN19-AU-000130 + Windows Server 2019 must be configured to audit Detailed Tracking - Plug and Play Events successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Plug and Play activity records events related to the successful connection of external devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + Configure the policy value for Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> "Audit PNP Activity" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Detailed Tracking >> Plug and Play Events - Success + + + + + SRG-OS-000470-GPOS-00214 + <GroupDescription></GroupDescription> + + WN19-AU-000170 + Windows Server 2019 must be configured to audit Logon/Logoff - Group Membership successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Group Membership records information related to the group membership of a user's logon token.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + Configure the policy value for Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Group Membership" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Group Membership - Success + + + + + SRG-OS-000470-GPOS-00214 + <GroupDescription></GroupDescription> + + WN19-AU-000210 + Windows Server 2019 must be configured to audit Logon/Logoff - Special Logon successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Special Logon records special logons that have administrative privileges and can be used to elevate processes. + +Satisfies: SRG-OS-000470-GPOS-00214, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000475-GPOS-00220</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Special Logon" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Special Logon - Success + + + + + SRG-OS-000470-GPOS-00214 + <GroupDescription></GroupDescription> + + WN19-AU-000220 + Windows Server 2019 must be configured to audit Object Access - Other Object Access Events successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Auditing for other object access records events related to the management of task scheduler jobs and COM+ objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Other Object Access Events" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Object Access >> Other Object Access Events - Success + + + + + SRG-OS-000470-GPOS-00214 + <GroupDescription></GroupDescription> + + WN19-AU-000230 + Windows Server 2019 must be configured to audit Object Access - Other Object Access Events failures. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Auditing for other object access records events related to the management of task scheduler jobs and COM+ objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Other Object Access Events" with "Failure" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Object Access >> Other Object Access Events - Failure + + + + + SRG-OS-000474-GPOS-00219 + <GroupDescription></GroupDescription> + + WN19-AU-000240 + Windows Server 2019 must be configured to audit Object Access - Removable Storage successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Object Access >> Removable Storage - Success + +Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding. + + + + + SRG-OS-000474-GPOS-00219 + <GroupDescription></GroupDescription> + + WN19-AU-000250 + Windows Server 2019 must be configured to audit Object Access - Removable Storage failures. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Failure" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Object Access >> Removable Storage - Failure + +Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding. + + + + + SRG-OS-000472-GPOS-00217 + <GroupDescription></GroupDescription> + + WN19-AU-000180 + Windows Server 2019 must be configured to audit logoff successes. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Logoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed. + +Satisfies: SRG-OS-000472-GPOS-00217, SRG-OS-000480-GPOS-00227</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000172 + CCI-000366 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logoff" with "Success" selected. + + + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Logoff - Success + + + + + SRG-OS-000042-GPOS-00020 + <GroupDescription></GroupDescription> + + WN19-CC-000090 + Windows Server 2019 command line data must be included in process creation events. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Enabling "Include command line data for process creation events" will record the command line information with the process creation events in the log. This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000135 + Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Audit Process Creation >> "Include command line in process creation events" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ + +Value Name: ProcessCreationIncludeCmdLine_Enabled + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000042-GPOS-00020 + <GroupDescription></GroupDescription> + + WN19-CC-000460 + Windows Server 2019 PowerShell script block logging must be enabled. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Enabling PowerShell script block logging will record detailed information from the processing of PowerShell commands and scripts. This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000135 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> "Turn on PowerShell Script Block Logging" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ + +Value Name: EnableScriptBlockLogging + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000341-GPOS-00132 + <GroupDescription></GroupDescription> + + WN19-CC-000270 + Windows Server 2019 Application event log size must be configured to 32768 KB or greater. + <VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001849 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Application >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater. + + + + If the system is configured to write events directly to an audit server, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Application\ + +Value Name: MaxSize + +Type: REG_DWORD +Value: 0x00008000 (32768) (or greater) + + + + + SRG-OS-000341-GPOS-00132 + <GroupDescription></GroupDescription> + + WN19-CC-000280 + Windows Server 2019 Security event log size must be configured to 196608 KB or greater. + <VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001849 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Security >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "196608" or greater. + + + + If the system is configured to write events directly to an audit server, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Security\ + +Value Name: MaxSize + +Type: REG_DWORD +Value: 0x00030000 (196608) (or greater) + + + + + SRG-OS-000341-GPOS-00132 + <GroupDescription></GroupDescription> + + WN19-CC-000290 + Windows Server 2019 System event log size must be configured to 32768 KB or greater. + <VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001849 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> System >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater. + + + + If the system is configured to write events directly to an audit server, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\System\ + +Value Name: MaxSize + +Type: REG_DWORD +Value: 0x00008000 (32768) (or greater) + + + + + SRG-OS-000342-GPOS-00133 + <GroupDescription></GroupDescription> + + WN19-AU-000010 + Windows Server 2019 audit records must be backed up to a different system or media than the system being audited. + <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001851 + Establish and implement a process for backing up log data to another system or media other than the system being audited. + + + + Determine if a process to back up log data to a different system or media than the system being audited has been implemented. + +If it has not, this is a finding. + + + + + SRG-OS-000479-GPOS-00224 + <GroupDescription></GroupDescription> + + WN19-AU-000020 + Windows Server 2019 must, at a minimum, off-load audit records of interconnected systems in real time and off-load standalone systems weekly. + <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001851 + Configure the system to, at a minimum, off-load audit records of interconnected systems in real time and off-load standalone systems weekly. + + + + Verify the audit records, at a minimum, are off-loaded for interconnected systems in real time and off-loaded for standalone systems weekly. + +If they are not, this is a finding. + + + + + SRG-OS-000355-GPOS-00143 + <GroupDescription></GroupDescription> + + WN19-00-000440 + The Windows Server 2019 time service must synchronize with an appropriate DoD time source. + <VulnDiscussion>The Windows Time Service controls time synchronization settings. Time synchronization is essential for authentication and auditing purposes. If the Windows Time Service is used, it must synchronize with a secure, authorized time source. Domain-joined systems are automatically configured to synchronize with domain controllers. If an NTP server is configured, it must synchronize with a secure, authorized time source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001891 + Configure the system to synchronize time with an appropriate DoD time source. + +Domain-joined systems use NT5DS to synchronize time from other systems in the domain by default. + +If the system needs to be configured to an NTP server, configure the system to point to an authorized time server by setting the policy value for Computer Configuration >> Administrative Templates >> System >> Windows Time Service >> Time Providers >> "Configure Windows NTP Client" to "Enabled", and configure the "NtpServer" field to point to an appropriate DoD time server. + +The US Naval Observatory operates stratum 1 time servers, identified at http://tycho.usno.navy.mil/ntp.html. Time synchronization will occur through a hierarchy of time servers down to the local level. Clients and lower-level servers will synchronize with an authorized time server in the hierarchy. + + + + Review the Windows time service configuration. + +Open an elevated "Command Prompt" (run as administrator). + +Enter "W32tm /query /configuration". + +Domain-joined systems (excluding the domain controller with the PDC emulator role): + +If the value for "Type" under "NTP Client" is not "NT5DS", this is a finding. + +Other systems: + +If systems are configured with a "Type" of "NTP", including standalone systems and the domain controller with the PDC Emulator role, and do not have a DoD time server defined for "NTPServer", this is a finding. + +To determine the domain controller with the PDC Emulator role: + +Open "PowerShell". + +Enter "Get-ADDomain | FT PDCEmulator". + + + + + SRG-OS-000057-GPOS-00027 + <GroupDescription></GroupDescription> + + WN19-AU-000030 + Windows Server 2019 permissions for the Application event log must prevent access by non-privileged accounts. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Application event log may be susceptible to tampering if proper permissions are not applied. + +Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000162 + CCI-000163 + CCI-000164 + Configure the permissions on the Application event log file (Application.evtx) to prevent access by non-privileged accounts. The default permissions listed below satisfy this requirement: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. + +If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog". + + + + Navigate to the Application event log file. + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. + +If the permissions for the "Application.evtx" file are not as restrictive as the default permissions listed below, this is a finding: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + + + + + SRG-OS-000057-GPOS-00027 + <GroupDescription></GroupDescription> + + WN19-AU-000040 + Windows Server 2019 permissions for the Security event log must prevent access by non-privileged accounts. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Security event log may disclose sensitive information or be susceptible to tampering if proper permissions are not applied. + +Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000162 + CCI-000163 + CCI-000164 + Configure the permissions on the Security event log file (Security.evtx) to prevent access by non-privileged accounts. The default permissions listed below satisfy this requirement: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. + +If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog". + + + + Navigate to the Security event log file. + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. + +If the permissions for the "Security.evtx" file are not as restrictive as the default permissions listed below, this is a finding: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + + + + + SRG-OS-000057-GPOS-00027 + <GroupDescription></GroupDescription> + + WN19-AU-000050 + Windows Server 2019 permissions for the System event log must prevent access by non-privileged accounts. + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The System event log may be susceptible to tampering if proper permissions are not applied. + +Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000162 + CCI-000163 + CCI-000164 + Configure the permissions on the System event log file (System.evtx) to prevent access by non-privileged accounts. The default permissions listed below satisfy this requirement: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. + +If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog". + + + + Navigate to the System event log file. + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. + +If the permissions for the "System.evtx" file are not as restrictive as the default permissions listed below, this is a finding: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + + + + + SRG-OS-000257-GPOS-00098 + <GroupDescription></GroupDescription> + + WN19-AU-000060 + Windows Server 2019 Event Viewer must be protected from unauthorized modification and deletion. + <VulnDiscussion>Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. + +Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order to make access decisions regarding the modification or deletion of audit tools. + +Satisfies: SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001494 + CCI-001495 + Configure the permissions on the "Eventvwr.exe" file to prevent modification by any groups or accounts other than TrustedInstaller. The default permissions listed below satisfy this requirement: + +TrustedInstaller - Full Control +Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES, ALL RESTRICTED APPLICATION PACKAGES - Read & Execute + +The default location is the "%SystemRoot%\System32" folder. + + + + Navigate to "%SystemRoot%\System32". + +View the permissions on "Eventvwr.exe". + +If any groups or accounts other than TrustedInstaller have "Full control" or "Modify" permissions, this is a finding. + +The default permissions below satisfy this requirement: + +TrustedInstaller - Full Control +Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES, ALL RESTRICTED APPLICATION PACKAGES - Read & Execute + + + + + SRG-OS-000362-GPOS-00149 + <GroupDescription></GroupDescription> + + WN19-CC-000420 + Windows Server 2019 must prevent users from changing installation options. + <VulnDiscussion>Installation options for applications are typically controlled by administrators. This setting prevents users from changing installation options that may bypass security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001812 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Allow user control over installs" to "Disabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ + +Value Name: EnableUserControl + +Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000362-GPOS-00149 + <GroupDescription></GroupDescription> + + WN19-CC-000430 + Windows Server 2019 must disable the Windows Installer Always install with elevated privileges option. + <VulnDiscussion>Standard user accounts must not be granted elevated privileges. Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001812 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Always install with elevated privileges" to "Disabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ + +Value Name: AlwaysInstallElevated + +Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000363-GPOS-00150 + <GroupDescription></GroupDescription> + + WN19-00-000220 + Windows Server 2019 system files must be monitored for unauthorized changes. + <VulnDiscussion>Monitoring system files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001744 + Monitor the system for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis. This can be done with the use of various monitoring tools. + + + + Determine whether the system is monitored for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis. + +If system files are not monitored for unauthorized changes, this is a finding. + +A properly configured HBSS Policy Auditor 5.2 or later File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-00-000030 + Windows Server 2019 administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. + <VulnDiscussion>Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account. + +Since administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy require administrative accounts to not access the Internet or use applications such as email. + +The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. + +Whitelisting can be used to enforce the policy to ensure compliance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Establish a policy, at minimum, to prohibit administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. Ensure the policy is enforced. + +The organization may use technical means such as whitelisting to prevent the use of browsers and mail applications to enforce this requirement. + + + + Determine whether organization policy, at a minimum, prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. + +If it does not, this is a finding. + +The organization may use technical means such as whitelisting to prevent the use of browsers and mail applications to enforce this requirement. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-00-000040 + Windows Server 2019 members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks. + <VulnDiscussion>Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Members of the Backup Operators group must have separate logon accounts for performing backup duties.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure each member of the Backup Operators group has separate accounts for backup functions and standard user functions. + + + + If no accounts are members of the Backup Operators group, this is NA. + +Verify users with accounts in the Backup Operators group have a separate user account for backup functions and for performing normal user tasks. + +If users with accounts in the Backup Operators group do not have separate accounts for backup functions and standard user functions, this is a finding. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-00-000060 + Windows Server 2019 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization. + <VulnDiscussion>Setting application account passwords to expire may cause applications to stop functioning. However, not changing them on a regular basis exposes them to attack. If managed service accounts are used, this alleviates the need to manually change application account passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Change passwords for manually managed application/service accounts at least annually or when an administrator with knowledge of the password leaves the organization. + +It is recommended that system-managed service accounts be used whenever possible. + + + + Determine if manually managed application/service accounts exist. If none exist, this is NA. + +If passwords for manually managed application/service accounts are not changed at least annually or when an administrator with knowledge of the password leaves the organization, this is a finding. + +Identify manually managed application/service accounts. + +To determine the date a password was last changed: + +Domain controllers: + +Open "PowerShell". + +Enter "Get-AdUser -Identity [application account name] -Properties PasswordLastSet | FT Name, PasswordLastSet", where [application account name] is the name of the manually managed application/service account. + +If the "PasswordLastSet" date is more than one year old, this is a finding. + + +Member servers and standalone systems: + +Open "Command Prompt". + +Enter 'Net User [application account name] | Find /i "Password Last Set"', where [application account name] is the name of the manually managed application/service account. + +If the "Password Last Set" date is more than one year old, this is a finding. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-DC-000430 + The password for the krbtgt account on a domain must be reset at least every 180 days. + <VulnDiscussion>The krbtgt account acts as a service account for the Kerberos Key Distribution Center (KDC) service. The account and password are created when a domain is created and the password is typically not changed. If the krbtgt account is compromised, attackers can create valid Kerberos Ticket Granting Tickets (TGT). + +The password must be changed twice to effectively remove the password history. Changing once, waiting for replication to complete and changing again reduces the risk of issues. Changing twice in rapid succession forces clients to re-authenticate (including application services) but is desired if a compromise is suspected.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Reset the password for the krbtgt account a least every 180 days. The password must be changed twice to effectively remove the password history. Changing once, waiting for replication to complete and changing again reduces the risk of issues. Changing twice in rapid succession forces clients to re-authenticate (including application services) but is desired if a compromise is suspected. + +PowerShell scripts are available to accomplish this such as at the following link: + +https://gallery.technet.microsoft.com/Reset-the-krbtgt-account-581a9e51 + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Select "Advanced Features" in the "View" menu if not previously selected. + +Select the "Users" node. + +Right click on the krbtgt account and select "Reset password" + +Enter a password that meets password complexity requirements. + +Clear the "User must change password at next logon" check box. + +The system will automatically change this to a system-generated complex password. + + + + This requirement is applicable to domain controllers; it is NA for other systems. + +Open "Windows PowerShell". + +Enter "Get-ADUser krbtgt -Property PasswordLastSet". + +If the "PasswordLastSet" date is more than 180 days old, this is a finding. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-00-000090 + Windows Server 2019 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use. + <VulnDiscussion>Credential Guard uses virtualization-based security to protect data that could be used in credential theft attacks if compromised. A number of system requirements must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure domain-joined systems have a TPM that is configured for use. (Versions 2.0 or 1.2 support Credential Guard.) + +The TPM must be enabled in the firmware. + +Run "tpm.msc" for configuration options in Windows. + + + + For standalone systems, this is NA. + +Current hardware and virtual environments may not support virtualization-based security features, including Credential Guard, due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within a virtual machine. + +Verify the system has a TPM and it is ready for use. + +Run "tpm.msc". + +Review the sections in the center pane. + +"Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has been taken". + +TPM Manufacturer Information - Specific Version = 2.0 or 1.2 + +If a TPM is not found or is not ready for use, this is a finding. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-00-000100 + Windows Server 2019 must be maintained at a supported servicing level. + <VulnDiscussion>Systems at unsupported servicing levels will not receive security updates for new vulnerabilities, which leave them subject to exploitation. Systems must be maintained at a servicing level supported by the vendor with new security updates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Update the system to a Version 1809 (Build 17763.xxx) or greater. + + + + Open "Command Prompt". + +Enter "winver.exe". + +If the "About Windows" dialog box does not display "Microsoft Windows Server Version 1809 (Build 17763.xxx)" or greater, this is a finding. + +Preview versions must not be used in a production environment. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-00-000110 + Windows Server 2019 must use an anti-virus program. + <VulnDiscussion>Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Install an anti-virus solution on the system. + + + + Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution. + +If there is no anti-virus solution installed on the system, this is a finding. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-00-000120 + Windows Server 2019 must have a host-based intrusion detection or prevention system. + <VulnDiscussion>A properly configured Host-based Intrusion Detection System (HIDS) or Host-based Intrusion Prevention System (HIPS) provides another level of defense against unauthorized access to critical servers. With proper configuration and logging enabled, such a system can stop and/or alert for many attempts to gain unauthorized access to resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Install a HIDS or HIPS on each server. + + + + Determine whether there is a HIDS or HIPS on each server. + +If the HIPS component of HBSS is installed and active on the host and the alerts of blocked activity are being logged and monitored, this meets the requirement. + +A HIDS device is not required on a system that has the role as the Network Intrusion Device (NID). However, this exception needs to be documented with the ISSO. + +If a HIDS is not installed on the system, this is a finding. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-00-000240 + Windows Server 2019 must have software certificate installation files removed. + <VulnDiscussion>Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Remove any certificate installation files (*.p12 and *.pfx) found on a system. + +Note: This does not apply to server-based applications that have a requirement for .p12 certificate files or Adobe PreFlight certificate files. + + + + Search all drives for *.p12 and *.pfx files. + +If any files with these extensions exist, this is a finding. + +This does not apply to server-based applications that have a requirement for .p12 certificate files or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-00-000420 + Windows Server 2019 FTP servers must be configured to prevent anonymous logons. + <VulnDiscussion>The FTP service allows remote users to access shared files and directories. Allowing anonymous FTP connections makes user auditing difficult. + +Using accounts that have administrator privileges to log on to FTP risks that the userid and password will be captured on the network and give administrator access to an unauthorized user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the FTP service to prevent anonymous logons. + +Open "Internet Information Services (IIS) Manager". + +Select the server. + +Double-click "FTP Authentication". + +Select "Anonymous Authentication". + +Select "Disabled" under "Actions". + + + + If FTP is not installed on the system, this is NA. + +Open "Internet Information Services (IIS) Manager". + +Select the server. + +Double-click "FTP Authentication". + +If the "Anonymous Authentication" status is "Enabled", this is a finding. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-00-000430 + Windows Server 2019 FTP servers must be configured to prevent access to the system drive. + <VulnDiscussion>The FTP service allows remote users to access shared files and directories that could provide access to system resources and compromise the system, especially if the user can gain access to the root directory of the boot drive.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the FTP sites to allow access only to specific FTP shared resources. Do not allow access to other areas of the system. + + + + If FTP is not installed on the system, this is NA. + +Open "Internet Information Services (IIS) Manager". + +Select "Sites" under the server name. + +For any sites with a Binding that lists FTP, right-click the site and select "Explore". + +If the site is not defined to a specific folder for shared FTP resources, this is a finding. + +If the site includes any system areas such as root of the drive, Program Files, or Windows directories, this is a finding. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-00-000460 + Windows Server 2019 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS. + <VulnDiscussion>UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in "Legacy BIOS" mode will not support these security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure UEFI firmware to run in "UEFI" mode, not "Legacy BIOS" mode. + + + + Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must run in "UEFI" mode. + +Verify the system firmware is configured to run in "UEFI" mode, not "Legacy BIOS". + +Run "System Information". + +Under "System Summary", if "BIOS Mode" does not display "UEFI", this is a finding. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-00-000470 + Windows Server 2019 must have Secure Boot enabled. + <VulnDiscussion>Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Enable Secure Boot in the system firmware. + + + + Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled. + +Run "System Information". + +Under "System Summary", if "Secure Boot State" does not display "On", this is a finding. + +On server core installations, run the following PowerShell command: + +Confirm-SecureBootUEFI + +If a value of "True" is not returned, this is a finding. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-CC-000030 + Windows Server 2019 Internet Protocol version 6 (IPv6) source routing must be configured to the highest protection level to prevent IP source routing. + <VulnDiscussion>Configuring the system to disable IPv6 source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)" to "Enabled" with "Highest protection, source routing is completely disabled" selected. + +This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively. + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ + +Value Name: DisableIPSourceRouting + +Type: REG_DWORD +Value: 0x00000002 (2) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-CC-000040 + Windows Server 2019 source routing must be configured to the highest protection level to prevent Internet Protocol (IP) source routing. + <VulnDiscussion>Configuring the system to disable IP source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)" to "Enabled" with "Highest protection, source routing is completely disabled" selected. + +This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively. + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ + +Value Name: DisableIPSourceRouting + +Value Type: REG_DWORD +Value: 0x00000002 (2) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-CC-000050 + Windows Server 2019 must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF)-generated routes. + <VulnDiscussion>Allowing ICMP redirect of routes can lead to traffic not being routed properly. When disabled, this forces ICMP to be routed via the shortest path first.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes" to "Disabled". + +This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively. + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ + +Value Name: EnableICMPRedirect + +Value Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-CC-000070 + Windows Server 2019 insecure logons to an SMB server must be disabled. + <VulnDiscussion>Insecure guest logons allow unauthenticated access to shared folders. Shared resources on a system must require authentication to establish proper access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Lanman Workstation >> "Enable insecure guest logons" to "Disabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation\ + +Value Name: AllowInsecureGuestAuth + +Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-CC-000080 + Windows Server 2019 hardened Universal Naming Convention (UNC) paths must be defined to require mutual authentication and integrity for at least the \\*\SYSVOL and \\*\NETLOGON shares. + <VulnDiscussion>Additional security requirements are applied to UNC paths specified in hardened UNC paths before allowing access to them. This aids in preventing tampering with or spoofing of connections to these paths.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Network Provider >> "Hardened UNC Paths" to "Enabled" with at least the following configured in "Hardened UNC Paths" (click the "Show" button to display): + +Value Name: \\*\SYSVOL +Value: RequireMutualAuthentication=1, RequireIntegrity=1 + +Value Name: \\*\NETLOGON +Value: RequireMutualAuthentication=1, RequireIntegrity=1 + + + + This requirement is applicable to domain-joined systems. For standalone systems, this is NA. + +If the following registry values do not exist or are not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\ + +Value Name: \\*\NETLOGON +Value Type: REG_SZ +Value: RequireMutualAuthentication=1, RequireIntegrity=1 + +Value Name: \\*\SYSVOL +Value Type: REG_SZ +Value: RequireMutualAuthentication=1, RequireIntegrity=1 + +Additional entries would not be a finding. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-CC-000100 + Windows Server 2019 must be configured to enable Remote host allows delegation of non-exportable credentials. + <VulnDiscussion>An exportable version of credentials is provided to remote hosts when using credential delegation which exposes them to theft on the remote host. Restricted Admin mode or Remote Credential Guard allow delegation of non-exportable credentials providing additional protection of the credentials. Enabling this configures the host to support Restricted Admin mode or Remote Credential Guard.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Credentials Delegation >> "Remote host allows delegation of non-exportable credentials" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\ + +Value Name: AllowProtectedCreds + +Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-CC-000110 + Windows Server 2019 virtualization-based security must be enabled with the platform security level configured to Secure Boot or Secure Boot with DMA Protection. + <VulnDiscussion>Virtualization Based Security (VBS) provides the platform for the additional security features Credential Guard and virtualization-based protection of code integrity. Secure Boot is the minimum security level, with DMA protection providing additional memory protection. DMA Protection requires a CPU that supports input/output memory management unit (IOMMU).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> "Turn On Virtualization Based Security" to "Enabled" with "Secure Boot" or "Secure Boot and DMA Protection" selected. + +A Microsoft TechNet article on Credential Guard, including system requirement details, can be found at the following link: + +https://technet.microsoft.com/itpro/windows/keep-secure/credential-guard + + + + For standalone systems, this is NA. + +Current hardware and virtual environments may not support virtualization-based security features, including Credential Guard, due to specific supporting requirements, including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within a virtual machine. + +Open "PowerShell" with elevated privileges (run as administrator). + +Enter the following: + +"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard" + +If "RequiredSecurityProperties" does not include a value of "2" indicating "Secure Boot" (e.g., "{1, 2}"), this is a finding. + +If "Secure Boot and DMA Protection" is configured, "3" will also be displayed in the results (e.g., "{1, 2, 3}"). + +If "VirtualizationBasedSecurityStatus" is not a value of "2" indicating "Running", this is a finding. + +Alternately: + +Run "System Information". + +Under "System Summary", verify the following: + +If "Device Guard Virtualization based security" does not display "Running", this is a finding. + +If "Device Guard Required Security Properties" does not display "Base Virtualization Support, Secure Boot", this is a finding. + +If "Secure Boot and DMA Protection" is configured, "DMA Protection" will also be displayed (e.g., "Base Virtualization Support, Secure Boot, DMA Protection"). + +The policy settings referenced in the Fix section will configure the following registry values. However, due to hardware requirements, the registry values alone do not ensure proper function. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ + +Value Name: EnableVirtualizationBasedSecurity +Value Type: REG_DWORD +Value: 0x00000001 (1) + +Value Name: RequirePlatformSecurityFeatures +Value Type: REG_DWORD +Value: 0x00000001 (1) (Secure Boot only) or 0x00000003 (3) (Secure Boot and DMA Protection) + +A Microsoft TechNet article on Credential Guard, including system requirement details, can be found at the following link: + +https://technet.microsoft.com/itpro/windows/keep-secure/credential-guard + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-CC-000130 + Windows Server 2019 Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers identified as bad. + <VulnDiscussion>Compromised boot drivers can introduce malware prior to protection mechanisms that load after initialization. The Early Launch Antimalware driver can limit allowed drivers based on classifications determined by the malware protection application. At a minimum, drivers determined to be bad must not be allowed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy to enforce "Good, unknown and bad but critical" (preventing "bad"). + +If this needs to be corrected or a more secure setting is desired, configure the policy value for Computer Configuration >> Administrative Templates >> System >> Early Launch Antimalware >> "Boot-Start Driver Initialization Policy" to "Not Configured" or "Enabled" with any option other than "All" selected. + + + + The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy to enforce "Good, unknown and bad but critical" (preventing "bad"). + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0x00000007 (7)", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Policies\EarlyLaunch\ + +Value Name: DriverLoadPolicy + +Value Type: REG_DWORD +Value: 0x00000001 (1), 0x00000003 (3), or 0x00000008 (8) (or if the Value Name does not exist) + +Possible values for this setting are: +8 - Good only +1 - Good and unknown +3 - Good, unknown and bad but critical +7 - All (which includes "bad" and would be a finding) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-CC-000140 + Windows Server 2019 group policy objects must be reprocessed even if they have not changed. + <VulnDiscussion>Registry entries for group policy settings can potentially be changed from the required configuration. This could occur as part of troubleshooting or by a malicious process on a compromised system. Enabling this setting and then selecting the "Process even if the Group Policy objects have not changed" option ensures the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Group Policy >> "Configure registry policy processing" to "Enabled" with the option "Process even if the Group Policy objects have not changed" selected. + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\ + +Value Name: NoGPOListChanges + +Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-CC-000180 + Windows Server 2019 users must be prompted to authenticate when the system wakes from sleep (on battery). + <VulnDiscussion>A system that does not require authentication when resuming from sleep may provide access to unauthorized users. Authentication must always be required when accessing a system. This setting ensures users are prompted for a password when the system wakes from sleep (on battery).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Power Management >> Sleep Settings >> "Require a password when a computer wakes (on battery)" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ + +Value Name: DCSettingIndex + +Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-CC-000190 + Windows Server 2019 users must be prompted to authenticate when the system wakes from sleep (plugged in). + <VulnDiscussion>A system that does not require authentication when resuming from sleep may provide access to unauthorized users. Authentication must always be required when accessing a system. This setting ensures users are prompted for a password when the system wakes from sleep (plugged in).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Power Management >> Sleep Settings >> "Require a password when a computer wakes (plugged in)" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ + +Value Name: ACSettingIndex + +Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-CC-000250 + Windows Server 2019 Telemetry must be configured to Security or Basic. + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information from being sent outside the enterprise. The "Security" option for Telemetry configures the lowest amount of data, effectively none outside of the Malicious Software Removal Tool (MSRT), Defender, and telemetry client settings. "Basic" sends basic diagnostic and usage data and may be required to support some Microsoft services.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Data Collection and Preview Builds>> "Allow Telemetry" to "Enabled" with "0 - Security [Enterprise Only]" or "1 - Basic" selected in "Options". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DataCollection\ + +Value Name: AllowTelemetry + +Type: REG_DWORD +Value: 0x00000000 (0) (Security), 0x00000001 (1) (Basic) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-CC-000260 + Windows Server 2019 Windows Update must not obtain updates from other PCs on the Internet. + <VulnDiscussion>Windows Update can obtain updates from additional sources instead of Microsoft. In addition to Microsoft, updates can be obtained from and sent to PCs on the local network as well as on the Internet. This is part of the Windows Update trusted process, however to minimize outside exposure, obtaining updates from or sending to systems on the Internet must be prevented.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Delivery Optimization >> "Download Mode" to "Enabled" with any option except "Internet" selected. + +Acceptable selections include: + +Bypass (100) +Group (2) +HTTP only (0) +LAN (1) +Simple (99) + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\ + +Value Name: DODownloadMode + +Value Type: REG_DWORD +Value: 0x00000000 (0) - No peering (HTTP Only) +0x00000001 (1) - Peers on same NAT only (LAN) +0x00000002 (2) - Local Network / Private group peering (Group) +0x00000063 (99) - Simple download mode, no peering (Simple) +0x00000064 (100) - Bypass mode, Delivery Optimization not used (Bypass) + +A value of 0x00000003 (3), Internet, is a finding. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-CC-000320 + Windows Server 2019 Turning off File Explorer heap termination on corruption must be disabled. + <VulnDiscussion>Legacy plug-in applications may continue to function when a File Explorer session has become corrupt. Disabling this feature will prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + The default behavior is for File Explorer heap termination on corruption to be disabled. + +If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Turn off heap termination on corruption" to "Not Configured" or "Disabled". + + + + The default behavior is for File Explorer heap termination on corruption to be enabled. + +If the registry Value Name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ + +Value Name: NoHeapTerminationOnCorruption + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-CC-000330 + Windows Server 2019 File Explorer shell protocol must run in protected mode. + <VulnDiscussion>The shell protocol will limit the set of folders that applications can open when run in protected mode. Restricting files an application can open to a limited set of folders increases the security of Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + The default behavior is for shell protected mode to be turned on for File Explorer. + +If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Turn off shell protocol protected mode" to "Not Configured" or "Disabled". + + + + The default behavior is for shell protected mode to be turned on for File Explorer. + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ + +Value Name: PreXPSP2ShellProtocolBehavior + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-CC-000390 + Windows Server 2019 must prevent attachments from being downloaded from RSS feeds. + <VulnDiscussion>Attachments from RSS feeds may not be secure. This setting will prevent attachments from being downloaded from RSS feeds.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> RSS Feeds >> "Prevent downloading of enclosures" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds\ + +Value Name: DisableEnclosureDownload + +Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-CC-000440 + Windows Server 2019 users must be notified if a web-based program attempts to install software. + <VulnDiscussion>Web-based programs may attempt to install malicious software on a system. Ensuring users are notified if a web-based program attempts to install software allows them to refuse the installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system. + +If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Prevent Internet Explorer security prompt for Windows Installer scripts" to "Not Configured" or "Disabled". + + + + The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system. + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ + +Value Name: SafeForScripting + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist) + + + + + SRG-OS-000480-GPOS-00229 + <GroupDescription></GroupDescription> + + WN19-CC-000450 + Windows Server 2019 must disable automatically signing in the last interactive user after a system-initiated restart. + <VulnDiscussion>Windows can be configured to automatically sign the user back in after a Windows Update restart. Some protections are in place to help ensure this is done in a secure fashion; however, disabling this will prevent the caching of credentials for this purpose and also ensure the user is aware of the restart.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Logon Options >> "Sign-in last interactive user automatically after a system-initiated restart" to "Disabled". + + + + Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: DisableAutomaticRestartSignOn + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-DC-000150 + Windows Server 2019 directory data (outside the root DSE) of a non-public directory must be configured to prevent anonymous access. + <VulnDiscussion>To the extent that anonymous access to directory data (outside the root DSE) is permitted, read access control of the data is effectively disabled. If other means of controlling access (such as network restrictions) are compromised, there may be nothing else to protect the confidentiality of sensitive directory data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure directory data (outside the root DSE) of a non-public directory to prevent anonymous access. + +For AD, there are multiple configuration items that could enable anonymous access. + +Changing the access permissions on the domain naming context object (from the secure defaults) could enable anonymous access. If the check procedures indicate this is the cause, the process that was used to change the permissions should be reversed. This could have been through the Windows Support Tools ADSI Edit console (adsiedit.msc). + +The dsHeuristics option is used. This is addressed in check V-8555 in the AD Forest STIG. + + + + This applies to domain controllers. It is NA for other systems. + +Open "Command Prompt" (not elevated). + +Run "ldp.exe". + +From the "Connection menu", select "Bind". + +Clear the User, Password, and Domain fields. + +Select "Simple bind" for the Bind type and click "OK". + +Confirmation of anonymous access will be displayed at the end: + +res = ldap_simple_bind_s +Authenticated as: 'NT AUTHORITY\ANONYMOUS LOGON' + +From the "Browse" menu, select "Search". + +In the Search dialog, enter the DN of the domain naming context (generally something like "dc=disaost,dc=mil") in the Base DN field. + +Clear the Attributes field and select "Run". + +Error messages should display related to Bind and user not authenticated. + +If attribute data is displayed, anonymous access is enabled to the domain naming context and this is a finding. + +The following network controls allow the finding severity to be downgraded to a CAT II since these measures lower the risk associated with anonymous access. + +Network hardware ports at the site are subject to 802.1x authentication or MAC address restrictions. + +Premise firewall or host restrictions prevent access to ports 389, 636, 3268, and 3269 from client hosts not explicitly identified by domain (.mil) or IP address. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-DC-000330 + Windows Server 2019 domain controllers must be configured to allow reset of machine account passwords. + <VulnDiscussion>Enabling this setting on all domain controllers in a domain prevents domain members from changing their computer account passwords. If these passwords are weak or compromised, the inability to change them may leave these computers vulnerable.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain controller: Refuse machine account password changes" to "Disabled". + + + + This applies to domain controllers. It is NA for other systems. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: RefusePasswordChange + +Value Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-SO-000020 + Windows Server 2019 must prevent local accounts with blank passwords from being used from the network. + <VulnDiscussion>An account without a password can allow unauthorized access to a system as only the username would be required. Password policies should prevent accounts with blank passwords from existing on a system. However, if a local account with a blank password does exist, enabling this setting will prevent network access, limiting the account to local console logon only.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Limit local account use of blank passwords to console logon only" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: LimitBlankPasswordUse + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-SO-000100 + Windows Server 2019 maximum age for machine account passwords must be configured to 30 days or less. + <VulnDiscussion>Computer account passwords are changed automatically on a regular basis. This setting controls the maximum password age that a machine account may have. This must be set to no more than 30 days, ensuring the machine changes its password monthly.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + This is the default configuration for this setting (30 days). + +Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Maximum machine account password age" to "30" or less (excluding "0", which is unacceptable). + + + + This is the default configuration for this setting (30 days). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: MaximumPasswordAge + +Value Type: REG_DWORD +Value: 0x0000001e (30) (or less, but not 0) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-SO-000150 + Windows Server 2019 Smart Card removal option must be configured to Force Logoff or Lock Workstation. + <VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked. Configuring a system to lock when a smart card is removed will ensure the system is inaccessible when unattended.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive logon: Smart card removal behavior" to "Lock Workstation" or "Force Logoff". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ + +Value Name: scremoveoption + +Value Type: REG_SZ +Value: 1 (Lock Workstation) or 2 (Force Logoff) + +If configuring this on servers causes issues, such as terminating users' remote sessions, and the organization has a policy in place that any other sessions on the servers, such as administrative console logons, are manually locked or logged off when unattended or not in use, this would be acceptable. This must be documented with the ISSO. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-SO-000210 + Windows Server 2019 must not allow anonymous SID/Name translation. + <VulnDiscussion>Allowing anonymous SID/Name translation can provide sensitive information for accessing a system. Only authorized users must be able to perform such translations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Allow anonymous SID/Name translation" to "Disabled". + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. + +If the value for "Network access: Allow anonymous SID/Name translation" is not set to "Disabled", this is a finding. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-SO-000220 + Windows Server 2019 must not allow anonymous enumeration of Security Account Manager (SAM) accounts. + <VulnDiscussion>Anonymous enumeration of SAM accounts allows anonymous logon users (null session connections) to list all accounts names, thus providing a list of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Do not allow anonymous enumeration of SAM accounts" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: RestrictAnonymousSAM + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-SO-000240 + Windows Server 2019 must be configured to prevent anonymous users from having the same permissions as the Everyone group. + <VulnDiscussion>Access by anonymous users must be restricted. If this setting is enabled, anonymous users have the same rights and permissions as the built-in Everyone group. Anonymous users must not have these permissions or rights.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Let Everyone permissions apply to anonymous users" to "Disabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: EveryoneIncludesAnonymous + +Value Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-SO-000260 + Windows Server 2019 services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity instead of authenticating anonymously. + <VulnDiscussion>Services using Local System that use Negotiate when reverting to NTLM authentication may gain unauthorized access if allowed to authenticate anonymously versus using the computer identity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Allow Local System to use computer identity for NTLM" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\ + +Value Name: UseMachineId + +Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-SO-000270 + Windows Server 2019 must prevent NTLM from falling back to a Null session. + <VulnDiscussion>NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Allow LocalSystem NULL session fallback" to "Disabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\MSV1_0\ + +Value Name: allownullsessionfallback + +Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-SO-000280 + Windows Server 2019 must prevent PKU2U authentication using online identities. + <VulnDiscussion>PKU2U is a peer-to-peer authentication protocol. This setting prevents online identities from authenticating to domain-joined systems. Authentication will be centrally managed with Windows user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Allow PKU2U authentication requests to this computer to use online identities" to "Disabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\pku2u\ + +Value Name: AllowOnlineID + +Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-SO-000310 + Windows Server 2019 LAN Manager authentication level must be configured to send NTLMv2 response only and to refuse LM and NTLM. + <VulnDiscussion>The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts. NTLM, which is less secure, is retained in later Windows versions for compatibility with clients and servers that are running earlier versions of Windows or applications that still use it. It is also used to authenticate logons to standalone computers that are running later versions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: LAN Manager authentication level" to "Send NTLMv2 response only. Refuse LM & NTLM". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: LmCompatibilityLevel + +Value Type: REG_DWORD +Value: 0x00000005 (5) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-SO-000320 + Windows Server 2019 must be configured to at least negotiate signing for LDAP client signing. + <VulnDiscussion>This setting controls the signing requirements for LDAP clients. This must be set to "Negotiate signing" or "Require signing", depending on the environment and type of LDAP server in use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: LDAP client signing requirements" to "Negotiate signing" at a minimum. + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LDAP\ + +Value Name: LDAPClientIntegrity + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-SO-000330 + Windows Server 2019 session security for NTLM SSP-based clients must be configured to require NTLMv2 session security and 128-bit encryption. + <VulnDiscussion>Microsoft has implemented a variety of security support providers for use with Remote Procedure Call (RPC) sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Minimum session security for NTLM SSP based (including secure RPC) clients" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected). + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ + +Value Name: NTLMMinClientSec + +Value Type: REG_DWORD +Value: 0x20080000 (537395200) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-SO-000340 + Windows Server 2019 session security for NTLM SSP-based servers must be configured to require NTLMv2 session security and 128-bit encryption. + <VulnDiscussion>Microsoft has implemented a variety of security support providers for use with Remote Procedure Call (RPC) sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Minimum session security for NTLM SSP based (including secure RPC) servers" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected). + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ + +Value Name: NTLMMinServerSec + +Value Type: REG_DWORD +Value: 0x20080000 (537395200) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-SO-000370 + Windows Server 2019 default permissions of global system objects must be strengthened. + <VulnDiscussion>Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default Discretionary Access Control List (DACL) that specifies who can access the objects with what permissions. When this policy is enabled, the default DACL is stronger, allowing non-administrative users to read shared objects but not to modify shared objects they did not create.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System objects: Strengthen default permissions of internal system objects (e.g., Symbolic Links)" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\ + +Value Name: ProtectionMode + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-UC-000010 + Windows Server 2019 must preserve zone information when saving attachments. + <VulnDiscussion>Attachments from outside sources may contain malicious code. Preserving zone of origin (Internet, intranet, local, restricted) information on file attachments allows Windows to determine risk.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + The default behavior is for Windows to mark file attachments with their zone information. + +If this needs to be corrected, configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Attachment Manager >> "Do not preserve zone information in file attachments" to "Not Configured" or "Disabled". + + + + The default behavior is for Windows to mark file attachments with their zone information. + +If the registry Value Name below does not exist, this is not a finding. + +If it exists and is configured with a value of "2", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\ + +Value Name: SaveZoneInformation + +Value Type: REG_DWORD +Value: 0x00000002 (2) (or if the Value Name does not exist) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000010 + Windows Server 2019 Exploit Protection system-level mitigation, Data Execution Prevention (DEP), must be on. + <VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Data Execution Prevention (DEP)", are enabled by default at the system level. DEP prevents code from being run from data-only memory pages. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure Exploit Protection system-level mitigation, "Data Execution Prevention (DEP)", is turned on. The default configuration in Exploit Protection is "On by default" which meets this requirement. + +Open "Windows Defender Security Center". + +Select "App & browser control". + +Select "Exploit protection settings". + +Under "System settings", configure "Data Execution Prevention (DEP)" to "On by default" or "Use default (<On>)". + +The STIG package includes a DoD EP XML file in the "Supporting Files" folder for configuring application mitigations defined in the STIG. This can also be modified to explicitly enforce the system level requirements. Adding the following to the XML file will explicitly turn DEP on (other system level EP requirements can be combined under <SystemConfig>): + +<SystemConfig> + <DEP Enable="true"></DEP> +</SystemConfig> + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "DEP: Enable" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000030 + Windows Server 2019 Exploit Protection system-level mitigation, Control flow guard (CFG), must be on. + <VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Control flow guard (CFG)", are enabled by default at the system level. CFG ensures flow integrity for indirect calls. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure Exploit Protection system-level mitigation, "Control flow guard (CFG)", is turned on. The default configuration in Exploit Protection is "On by default" which meets this requirement. + +Open "Windows Defender Security Center". + +Select "App & browser control". + +Select "Exploit protection settings". + +Under "System settings", configure "Control flow guard (CFG)" to "On by default" or "Use default (<On>)". + +The STIG package includes a DoD EP XML file in the "Supporting Files" folder for configuring application mitigations defined in the STIG. This can also be modified to explicitly enforce the system level requirements. Adding the following to the XML file will explicitly turn CFG on (other system level EP requirements can be combined under <SystemConfig>): + +<SystemConfig> + <ControlFlowGuard Enable="true"></ControlFlowGuard> +</SystemConfig> + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "CFG: Enable" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000040 + Windows Server 2019 Exploit Protection system-level mitigation, Validate exception chains (SEHOP), must be on. + <VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Validate exception chains (SEHOP)", are enabled by default at the system level. SEHOP (structured exception handling overwrite protection) ensures the integrity of an exception chain during exception dispatch. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure Exploit Protection system-level mitigation, "Validate exception chains (SEHOP)", is turned on. The default configuration in Exploit Protection is "On by default" which meets this requirement. + +Open "Windows Defender Security Center". + +Select "App & browser control". + +Select "Exploit protection settings". + +Under "System settings", configure "Validate exception chains (SEHOP)" to "On by default" or "Use default (<On>)". + +The STIG package includes a DoD EP XML file in the "Supporting Files" folder for configuring application mitigations defined in the STIG. This can also be modified to explicitly enforce the system level requirements. Adding the following to the XML file will explicitly turn SEHOP on (other system level EP requirements can be combined under <SystemConfig>): + +<SystemConfig> + <SEHOP Enable="true"></SEHOP> +</SystemConfig> + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "SEHOP: Enable" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000050 + Windows Server 2019 Exploit Protection system-level mitigation, Validate heap integrity, must be on. + <VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Validate heap integrity", are enabled by default at the system level. "Validate heap integrity" terminates a process when heap corruption is detected. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure Exploit Protection system-level mitigation, "Validate heap integrity" is turned on. The default configuration in Exploit Protection is "On by default" which meets this requirement. + +Open "Windows Defender Security Center". + +Select "App & browser control". + +Select "Exploit protection settings". + +Under "System settings", configure "Validate heap integrity" to "On by default" or "Use default (<On>)". + +The STIG package includes a DoD EP XML file in the "Supporting Files" folder for configuring application mitigations defined in the STIG. This can also be modified to explicitly enforce the system level requirements. Adding the following to the XML file will explicitly turn Validate heap integrity on (other system level EP requirements can be combined under <SystemConfig>): + +<SystemConfig> + <Heap TerminateOnError="true"></Heap> +</SystemConfig> + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "Heap: TerminateOnError" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration) + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000060 + Windows Server 2019 Exploit Protection mitigations must be configured for Acrobat.exe. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for Acrobat.exe: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name Acrobat.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000070 + Windows Server 2019 Exploit Protection mitigations must be configured for AcroRd32.exe. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for AcroRd32.exe: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name AcroRd32.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000080 + Windows Server 2019 Exploit Protection mitigations must be configured for chrome.exe. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for chrome.exe: + +DEP: +Enable: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name chrome.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000090 + Windows Server 2019 Exploit Protection mitigations must be configured for EXCEL.EXE. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for EXCEL.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name EXCEL.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000100 + Windows Server 2019 Exploit Protection mitigations must be configured for firefox.exe. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for firefox.exe: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name firefox.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000110 + Windows Server 2019 Exploit Protection mitigations must be configured for FLTLDR.EXE. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for FLTLDR.EXE: + +DEP: +Enable: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Child Process: +DisallowChildProcessCreation: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name FLTLDR.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Child Process: +DisallowChildProcessCreation: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000120 + Windows Server 2019 Exploit Protection mitigations must be configured for GROOVE.EXE. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for GROOVE.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Child Process: +DisallowChildProcessCreation: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name GROOVE.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Child Process: +DisallowChildProcessCreation: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000130 + Windows Server 2019 Exploit Protection mitigations must be configured for iexplore.exe. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for iexplore.exe: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name iexplore.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000140 + Windows Server 2019 Exploit Protection mitigations must be configured for INFOPATH.EXE. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for INFOPATH.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name INFOPATH.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000150 + Windows Server 2019 Exploit Protection mitigations must be configured for java.exe, javaw.exe, and javaws.exe. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for java.exe, javaw.exe, and javaws.exe: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name [application name]" with each of the following substituted for [application name]: +java.exe, javaw.exe, and javaws.exe +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON" for each, this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000160 + Windows Server 2019 Exploit Protection mitigations must be configured for lync.exe. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for lync.exe: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name lync.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000170 + Windows Server 2019 Exploit Protection mitigations must be configured for MSACCESS.EXE. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for MSACCESS.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name MSACCESS.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000180 + Windows Server 2019 Exploit Protection mitigations must be configured for MSPUB.EXE. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for MSPUB.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name MSPUB.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000190 + Windows Server 2019 Exploit Protection mitigations must be configured for OIS.EXE. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for OIS.EXE: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name OIS.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000200 + Windows Server 2019 Exploit Protection mitigations must be configured for OneDrive.exe. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for OneDrive.exe: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name OneDrive.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000210 + Windows Server 2019 Exploit Protection mitigations must be configured for OUTLOOK.EXE. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for OUTLOOK.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name OUTLOOK.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000220 + Windows Server 2019 Exploit Protection mitigations must be configured for plugin-container.exe. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for plugin-container.exe: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name plugin-container.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000230 + Windows Server 2019 Exploit Protection mitigations must be configured for POWERPNT.EXE. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for POWERPNT.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name POWERPNT.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000240 + Windows Server 2019 Exploit Protection mitigations must be configured for PPTVIEW.EXE. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for PPTVIEW.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name PPTVIEW.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000250 + Windows Server 2019 Exploit Protection mitigations must be configured for VISIO.EXE. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for VISIO.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name VISIO.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000260 + Windows Server 2019 Exploit Protection mitigations must be configured for VPREVIEW.EXE. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for VPREVIEW.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name VPREVIEW.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000270 + Windows Server 2019 Exploit Protection mitigations must be configured for WINWORD.EXE. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for WINWORD.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name WINWORD.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000280 + Windows Server 2019 Exploit Protection mitigations must be configured for wmplayer.exe. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for wmplayer.exe: + +DEP: +Enable: ON + +Payload: +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name wmplayer.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +Payload: +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-EP-000290 + Windows Server 2019 Exploit Protection mitigations must be configured for wordpad.exe. + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure the following mitigations are turned "ON" for wordpad.exe: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name wordpad.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-00-000010 + Windows Server 2019 users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks. + <VulnDiscussion>Using a privileged account to perform routine functions makes the computer vulnerable to malicious software inadvertently introduced during a session that has been granted full privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Ensure each user with administrative privileges has a separate account for user duties and one for privileged duties. + + + + Verify each user with administrative privileges has been assigned a unique administrative account separate from their standard user account. + +If users with administrative privileges do not have separate accounts for administrative functions and standard user functions, this is a finding. + + + + + SRG-OS-000368-GPOS-00154 + <GroupDescription></GroupDescription> + + WN19-CC-000210 + Windows Server 2019 Autoplay must be turned off for non-volume devices. + <VulnDiscussion>Allowing AutoPlay to execute may introduce malicious code to a system. AutoPlay begins reading from a drive as soon as media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. This setting will disable AutoPlay for non-volume devices, such as Media Transfer Protocol (MTP) devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001764 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Disallow Autoplay for non-volume devices" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ + +Value Name: NoAutoplayfornonVolume + +Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000368-GPOS-00154 + <GroupDescription></GroupDescription> + + WN19-CC-000220 + Windows Server 2019 default AutoRun behavior must be configured to prevent AutoRun commands. + <VulnDiscussion>Allowing AutoRun commands to execute may introduce malicious code to a system. Configuring this setting prevents AutoRun commands from executing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001764 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Set the default behavior for AutoRun" to "Enabled" with "Do not execute any autorun commands" selected. + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ + +Value Name: NoAutorun + +Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000368-GPOS-00154 + <GroupDescription></GroupDescription> + + WN19-CC-000230 + Windows Server 2019 AutoPlay must be disabled for all drives. + <VulnDiscussion>Allowing AutoPlay to execute may introduce malicious code to a system. AutoPlay begins reading from a drive as soon media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. By default, AutoPlay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive) and on network drives. Enabling this policy disables AutoPlay on all drives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001764 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Turn off AutoPlay" to "Enabled" with "All Drives" selected. + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ + +Value Name: NoDriveTypeAutoRun + +Type: REG_DWORD +Value: 0x000000ff (255) + + + + + SRG-OS-000370-GPOS-00155 + <GroupDescription></GroupDescription> + + WN19-00-000080 + Windows Server 2019 must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. + <VulnDiscussion>Using a whitelist provides a configuration management method to allow the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. + +The organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001774 + Configure an application whitelisting program to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. + +Configuration of whitelisting applications will vary by the program. AppLocker is a whitelisting application built into Windows Server. + +If AppLocker is used, it is configured through group policy in Computer Configuration >> Windows Settings >> Security Settings >> Application Control Policies >> AppLocker. + +Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link: + +https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm + + + + This is applicable to unclassified systems. For other systems, this is NA. + +Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. + +If an application whitelisting program is not in use on the system, this is a finding. + +Configuration of whitelisting applications will vary by the program. + +AppLocker is a whitelisting application built into Windows Server. A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules. + +If AppLocker is used, perform the following to view the configuration of AppLocker: + +Open "PowerShell". + +If the AppLocker PowerShell module has not been imported previously, execute the following first: + +Import-Module AppLocker + +Execute the following command, substituting [c:\temp\file.xml] with a location and file name appropriate for the system: + +Get-AppLockerPolicy -Effective -XML > c:\temp\file.xml + +This will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review. + +Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link: + +https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-00-000270 + Windows Server 2019 must have the roles and features required by the system documented. + <VulnDiscussion>Unnecessary roles and features increase the attack surface of a system. Limiting roles and features of a system to only those necessary reduces this potential. The standard installation option (previously called Server Core) further reduces this when selected at installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Document the roles and features required for the system to operate. Uninstall any that are not required. + + + + Required roles and features will vary based on the function of the individual system. + +Roles and features specifically required to be disabled per the STIG are identified in separate requirements. + +If the organization has not documented the roles and features required for the system(s), this is a finding. + +The PowerShell command "Get-WindowsFeature" will list all roles and features with an "Install State". + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-00-000320 + Windows Server 2019 must not have the Fax Server role installed. + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Uninstall the "Fax Server" role. + +Start "Server Manager". + +Select the server with the role. + +Scroll down to "ROLES AND FEATURES" in the right pane. + +Select "Remove Roles and Features" from the drop-down "TASKS" list. + +Select the appropriate server on the "Server Selection" page and click "Next". + +Deselect "Fax Server" on the "Roles" page. + +Click "Next" and "Remove" as prompted. + + + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq Fax". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-00-000340 + Windows Server 2019 must not have the Peer Name Resolution Protocol installed. + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Uninstall the "Peer Name Resolution Protocol" feature. + +Start "Server Manager". + +Select the server with the feature. + +Scroll down to "ROLES AND FEATURES" in the right pane. + +Select "Remove Roles and Features" from the drop-down "TASKS" list. + +Select the appropriate server on the "Server Selection" page and click "Next". + +Deselect "Peer Name Resolution Protocol" on the "Features" page. + +Click "Next" and "Remove" as prompted. + + + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq PNRP". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-00-000350 + Windows Server 2019 must not have Simple TCP/IP Services installed. + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Uninstall the "Simple TCP/IP Services" feature. + +Start "Server Manager". + +Select the server with the feature. + +Scroll down to "ROLES AND FEATURES" in the right pane. + +Select "Remove Roles and Features" from the drop-down "TASKS" list. + +Select the appropriate server on the "Server Selection" page and click "Next". + +Deselect "Simple TCP/IP Services" on the "Features" page. + +Click "Next" and "Remove" as prompted. + + + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq Simple-TCPIP". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-00-000370 + Windows Server 2019 must not have the TFTP Client installed. + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Uninstall the "TFTP Client" feature. + +Start "Server Manager". + +Select the server with the feature. + +Scroll down to "ROLES AND FEATURES" in the right pane. + +Select "Remove Roles and Features" from the drop-down "TASKS" list. + +Select the appropriate server on the "Server Selection" page and click "Next". + +Deselect "TFTP Client" on the "Features" page. + +Click "Next" and "Remove" as prompted. + + + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq TFTP-Client". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-00-000380 + Windows Server 2019 must not the Server Message Block (SMB) v1 protocol installed. + <VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks and is not FIPS compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Uninstall the SMBv1 protocol. + +Open "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Uninstall-WindowsFeature -Name FS-SMB1 -Restart". +(Omit the Restart parameter if an immediate restart of the system cannot be done.) + +Alternately: + +Start "Server Manager". + +Select the server with the feature. + +Scroll down to "ROLES AND FEATURES" in the right pane. + +Select "Remove Roles and Features" from the drop-down "TASKS" list. + +Select the appropriate server on the "Server Selection" page and click "Next". + +Deselect "SMB 1.0/CIFS File Sharing Support" on the "Features" page. + +Click "Next" and "Remove" as prompted. + + + + Different methods are available to disable SMBv1 on Windows Server 2019. This is the preferred method, however if WN19-00-000390 and WN19-00-000400 are configured, this is NA. + +Open "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-WindowsFeature -Name FS-SMB1". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-00-000390 + Windows Server 2019 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server. + <VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 Server" to "Disabled". + +The system must be restarted for the change to take effect. + +This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively. + + + + Different methods are available to disable SMBv1 on Windows Server 2019, if WN19-00-000380 is configured, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\ + +Value Name: SMB1 + +Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-00-000400 + Windows Server 2019 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client. + <VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 client driver" to "Enabled" with "Disable driver (recommended)" selected for "Configure MrxSmb10 driver". + +The system must be restarted for the changes to take effect. + +This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively. + + + + Different methods are available to disable SMBv1 on Windows Server 2019, if WN19-00-000380 is configured, this is NA. + +If the following registry value is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\ + +Value Name: Start + +Type: REG_DWORD +Value: 0x00000004 (4) + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-00-000410 + Windows Server 2019 must not have Windows PowerShell 2.0 installed. + <VulnDiscussion>Windows PowerShell 5.x added advanced logging features that can provide additional detail when malware has been run on a system. Disabling the Windows PowerShell 2.0 mitigates against a downgrade attack that evades the Windows PowerShell 5.x script block logging feature.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Uninstall the "Windows PowerShell 2.0 Engine". + +Start "Server Manager". + +Select the server with the feature. + +Scroll down to "ROLES AND FEATURES" in the right pane. + +Select "Remove Roles and Features" from the drop-down "TASKS" list. + +Select the appropriate server on the "Server Selection" page and click "Next". + +Deselect "Windows PowerShell 2.0 Engine" under "Windows PowerShell" on the "Features" page. + +Click "Next" and "Remove" as prompted. + + + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq PowerShell-v2". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-CC-000010 + Windows Server 2019 must prevent the display of slide shows on the lock screen. + <VulnDiscussion>Slide shows that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged-on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Configure the policy value for Computer Configuration >> Administrative Templates >> Control Panel >> Personalization >> "Prevent enabling lock screen slide show" to "Enabled". + + + + Verify the registry value below. + +If it does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Personalization\ + +Value Name: NoLockScreenSlideshow + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-CC-000020 + Windows Server 2019 must have WDigest Authentication disabled. + <VulnDiscussion>When the WDigest Authentication protocol is enabled, plain-text passwords are stored in the Local Security Authority Subsystem Service (LSASS), exposing them to theft. WDigest is disabled by default in Windows Server 2019. This setting ensures this is enforced.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "WDigest Authentication (disabling may require KB2871997)" to "Disabled". + +This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and " SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively. + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest\ + +Value Name: UseLogonCredential + +Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-CC-000150 + Windows Server 2019 downloading print driver packages over HTTP must be turned off. + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and will prevent uncontrolled updates to the system. + +This setting prevents the computer from downloading print driver packages over HTTP.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> "Turn off downloading of print drivers over HTTP" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\ + +Value Name: DisableWebPnPDownload + +Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-CC-000160 + Windows Server 2019 printing over HTTP must be turned off. + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and will prevent uncontrolled updates to the system. + +This setting prevents the client computer from printing over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> "Turn off printing over HTTP" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\ + +Value Name: DisableHTTPPrinting + +Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-CC-000170 + Windows Server 2019 network selection user interface (UI) must not be displayed on the logon screen. + <VulnDiscussion>Enabling interaction with the network selection UI allows users to change connections to available networks without signing in to Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> "Do not display network selection UI" to "Enabled". + + + + Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ + +Value Name: DontDisplayNetworkSelectionUI + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-CC-000200 + Windows Server 2019 Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft. + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and will prevent uncontrolled updates to the system. + +This setting will prevent the Program Inventory from collecting data about a system and sending the information to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Application Compatibility >> "Turn off Inventory Collector" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppCompat\ + +Value Name: DisableInventory + +Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-CC-000300 + Windows Server 2019 Windows Defender SmartScreen must be enabled. + <VulnDiscussion>Windows Defender SmartScreen helps protect systems from programs downloaded from the internet that may be malicious. Enabling SmartScreen can block potentially malicious programs or warn users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Configure Windows Defender SmartScreen" to "Enabled" with either option "Warn" or "Warn and prevent bypass" selected. + +Windows 2019 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Explorer. + + + + This is applicable to unclassified systems; for other systems, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ + +Value Name: EnableSmartScreen + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-CC-000400 + Windows Server 2019 must disable Basic authentication for RSS feeds over HTTP. + <VulnDiscussion>Basic authentication uses plain-text passwords that could be used to compromise a system. Disabling Basic authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections. + +If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> RSS Feeds >> "Turn on Basic feed authentication over HTTP" to "Not Configured" or "Disabled". + + + + The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections. + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds\ + +Value Name: AllowBasicAuthInClear + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist) + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-CC-000410 + Windows Server 2019 must prevent Indexing of encrypted files. + <VulnDiscussion>Indexing of encrypted files may expose sensitive data. This setting prevents encrypted files from being indexed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Search >> "Allow indexing of encrypted files" to "Disabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Windows Search\ + +Value Name: AllowIndexingEncryptedStoresOrItems + +Value Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000095-GPOS-00049 + <GroupDescription></GroupDescription> + + WN19-DC-000130 + Windows Server 2019 domain controllers must run on a machine dedicated to that function. + <VulnDiscussion>Executing application servers on the same host machine with a directory server may substantially weaken the security of the directory server. Web or database server applications usually require the addition of many programs and accounts, increasing the attack surface of the computer. + +Some applications require the addition of privileged accounts, providing potential sources of compromise. Some applications (such as Microsoft Exchange) may require the use of network ports or services conflicting with the directory server. In this case, non-standard ports might be selected, and this could interfere with intrusion detection or prevention services.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000381 + Remove additional roles or applications such as web, database, and email from the domain controller. + + + + This applies to domain controllers, it is NA for other systems. + +Review the installed roles the domain controller is supporting. + +Start "Server Manager". + +Select "AD DS" in the left pane and the server name under "Servers" to the right. + +Select "Add (or Remove) Roles and Features" from "Tasks" in the "Roles and Features" section. (Cancel before any changes are made.) + +Determine if any additional server roles are installed. A basic domain controller setup will include the following: + +- Active Directory Domain Services +- DNS Server +- File and Storage Services + +If any roles not requiring installation on a domain controller are installed, this is a finding. + +A Domain Name System (DNS) server integrated with the directory server (e.g., AD-integrated DNS) is an acceptable application. However, the DNS server must comply with the DNS STIG security requirements. + +Run "Programs and Features". + +Review installed applications. + +If any applications are installed that are not required for the domain controller, this is a finding. + + + + + SRG-OS-000096-GPOS-00050 + <GroupDescription></GroupDescription> + + WN19-00-000330 + Windows Server 2019 must not have the Microsoft FTP service installed unless required by the organization. + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000382 + Uninstall the "FTP Server" role. + +Start "Server Manager". + +Select the server with the role. + +Scroll down to "ROLES AND FEATURES" in the right pane. + +Select "Remove Roles and Features" from the drop-down "TASKS" list. + +Select the appropriate server on the "Server Selection" page and click "Next". + +Deselect "FTP Server" under "Web Server (IIS)" on the "Roles" page. + +Click "Next" and "Remove" as prompted. + + + + If the server has the role of an FTP server, this is NA. + +Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq Web-Ftp-Service". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + +If the system has the role of an FTP server, this must be documented with the ISSO. + + + + + SRG-OS-000096-GPOS-00050 + <GroupDescription></GroupDescription> + + WN19-00-000360 + Windows Server 2019 must not have the Telnet Client installed. + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000382 + Uninstall the "Telnet Client" feature. + +Start "Server Manager". + +Select the server with the feature. + +Scroll down to "ROLES AND FEATURES" in the right pane. + +Select "Remove Roles and Features" from the drop-down "TASKS" list. + +Select the appropriate server on the "Server Selection" page and click "Next". + +Deselect "Telnet Client" on the "Features" page. + +Click "Next" and "Remove" as prompted. + + + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq Telnet-Client". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + + + SRG-OS-000373-GPOS-00157 + <GroupDescription></GroupDescription> + + WN19-CC-000340 + Windows Server 2019 must not save passwords in the Remote Desktop Client. + <VulnDiscussion>Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system. The system must be configured to prevent users from saving passwords in the Remote Desktop Client. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002038 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Connection Client >> "Do not allow passwords to be saved" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: DisablePasswordSaving + +Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000373-GPOS-00157 + <GroupDescription></GroupDescription> + + WN19-CC-000360 + Windows Server 2019 Remote Desktop Services must always prompt a client for passwords upon connection. + <VulnDiscussion>This setting controls the ability of users to supply passwords automatically as part of their remote desktop connection. Disabling this setting would allow anyone to use the stored credentials in a connection item to connect to the terminal server. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002038 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> "Always prompt for password upon connection" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fPromptForPassword + +Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000373-GPOS-00157 + <GroupDescription></GroupDescription> + + WN19-CC-000520 + Windows Server 2019 Windows Remote Management (WinRM) service must not store RunAs credentials. + <VulnDiscussion>Storage of administrative credentials could allow unauthorized access. Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002038 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Disallow WinRM from storing RunAs credentials" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ + +Value Name: DisableRunAs + +Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000373-GPOS-00157 + <GroupDescription></GroupDescription> + + WN19-SO-000380 + Windows Server 2019 User Account Control approval mode for the built-in Administrator must be enabled. + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the built-in Administrator account so that it runs in Admin Approval Mode. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002038 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Admin Approval Mode for the Built-in Administrator account" to "Enabled". + + + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: FilterAdministratorToken + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000373-GPOS-00157 + <GroupDescription></GroupDescription> + + WN19-SO-000410 + Windows Server 2019 User Account Control must automatically deny standard user requests for elevation. + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting controls the behavior of elevation when requested by a standard user account. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002038 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests". + + + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: ConsentPromptBehaviorUser + +Value Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000373-GPOS-00157 + <GroupDescription></GroupDescription> + + WN19-SO-000440 + Windows Server 2019 User Account Control must run all administrators in Admin Approval Mode, enabling UAC. + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting enables UAC. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002038 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Run all administrators in Admin Approval Mode" to "Enabled". + + + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableLUA + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000104-GPOS-00051 + <GroupDescription></GroupDescription> + + WN19-00-000070 + Windows Server 2019 shared user accounts must not be permitted. + <VulnDiscussion>Shared accounts (accounts where two or more people log on with the same user identification) do not provide adequate identification and authentication. There is no way to provide for nonrepudiation or individual accountability for system access and resource usage.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000764 + Remove unapproved shared accounts from the system. + +Document required shared accounts with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity. + + + + Determine whether any shared accounts exist. If no shared accounts exist, this is NA. + +Shared accounts, such as required by an application, may be approved by the organization. This must be documented with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity. + +If unapproved shared accounts exist, this is a finding. + + + + + SRG-OS-000104-GPOS-00051 + <GroupDescription></GroupDescription> + + WN19-00-000200 + Windows Server 2019 accounts must require passwords. + <VulnDiscussion>The lack of password protection enables anyone to gain access to the information system, which opens a backdoor opportunity for intruders to compromise the system as well as other resources. Accounts on a system must require passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000764 + Configure all enabled accounts to require passwords. + +The password required flag can be set by entering the following on a command line: "Net user [username] /passwordreq:yes", substituting [username] with the name of the user account. + + + + Review the password required status for enabled user accounts. + +Open "PowerShell". + +Domain Controllers: + +Enter "Get-Aduser -Filter * -Properties Passwordnotrequired |FT Name, Passwordnotrequired, Enabled". + +Exclude disabled accounts (e.g., DefaultAccount, Guest) and Trusted Domain Objects (TDOs). + +If "Passwordnotrequired" is "True" or blank for any enabled user account, this is a finding. + +Member servers and standalone systems: + +Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordRequired=False and LocalAccount=True" | FT Name, PasswordRequired, Disabled, LocalAccount'. + +Exclude disabled accounts (e.g., DefaultAccount, Guest). + +If any enabled user accounts are returned with a "PasswordRequired" status of "False", this is a finding. + + + + + SRG-OS-000105-GPOS-00052 + <GroupDescription></GroupDescription> + + WN19-DC-000310 + Windows Server 2019 Active Directory user accounts, including administrators, must be configured to require the use of a Common Access Card (CAC), Personal Identity Verification (PIV)-compliant hardware token, or Alternate Logon Token (ALT) for user authentication. + <VulnDiscussion>Smart cards such as the CAC support a two-factor authentication technique. This provides a higher level of trust in the asserted identity than use of the username and password for authentication. + +Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055, SRG-OS-000375-GPOS-00160</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000765 + CCI-000766 + CCI-000767 + CCI-000768 + CCI-001948 + Configure all user accounts, including administrator accounts, in Active Directory to enable the option "Smart card is required for interactive logon". + +Run "Active Directory Users and Computers" (available from various menus or run "dsa.msc"): + +Select the OU where the user accounts are located. (By default this is the Users node; however, accounts may be under other organization-defined OUs.) + +Right-click the user account and select "Properties". + +Select the "Account" tab. + +Check "Smart card is required for interactive logon" in the "Account Options" area. + + + + This applies to domain controllers. It is NA for other systems. + +Open "PowerShell". + +Enter the following: + +"Get-ADUser -Filter {(Enabled -eq $True) -and (SmartcardLogonRequired -eq $False)} | FT Name" +("DistinguishedName" may be substituted for "Name" for more detailed output.) + +If any user accounts, including administrators, are listed, this is a finding. + + +Alternately: + +To view sample accounts in "Active Directory Users and Computers" (available from various menus or run "dsa.msc"): + +Select the Organizational Unit (OU) where the user accounts are located. (By default, this is the Users node; however, accounts may be under other organization-defined OUs.) + +Right-click the sample user account and select "Properties". + +Select the "Account" tab. + +If any user accounts, including administrators, do not have "Smart card is required for interactive logon" checked in the "Account Options" area, this is a finding. + + + + + SRG-OS-000112-GPOS-00057 + <GroupDescription></GroupDescription> + + WN19-DC-000020 + Windows Server 2019 Kerberos user logon restrictions must be enforced. + <VulnDiscussion>This policy setting determines whether the Kerberos Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the target computer. The policy is enabled by default, which is the most secure setting for validating that access to target resources is not circumvented. + +Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001941 + CCI-001942 + Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Enforce user logon restrictions" to "Enabled". + + + + This applies to domain controllers. It is NA for other systems. + +Verify the following is configured in the Default Domain Policy: + +Open "Group Policy Management". + +Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). + +Right-click on the "Default Domain Policy". + +Select "Edit". + +Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. + +If the "Enforce user logon restrictions" is not set to "Enabled", this is a finding. + + + + + SRG-OS-000112-GPOS-00057 + <GroupDescription></GroupDescription> + + WN19-DC-000030 + Windows Server 2019 Kerberos service ticket maximum lifetime must be limited to 600 minutes or less. + <VulnDiscussion>This setting determines the maximum amount of time (in minutes) that a granted session ticket can be used to access a particular service. Session tickets are used only to authenticate new connections with servers. Ongoing operations are not interrupted if the session ticket used to authenticate the connection expires during the connection. + +Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001941 + CCI-001942 + Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Maximum lifetime for service ticket" to a maximum of "600" minutes, but not "0", which equates to "Ticket doesn't expire". + + + + This applies to domain controllers. It is NA for other systems. + +Verify the following is configured in the Default Domain Policy: + +Open "Group Policy Management". + +Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). + +Right-click on the "Default Domain Policy". + +Select "Edit". + +Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. + +If the value for "Maximum lifetime for service ticket" is "0" or greater than "600" minutes, this is a finding. + + + + + SRG-OS-000112-GPOS-00057 + <GroupDescription></GroupDescription> + + WN19-DC-000040 + Windows Server 2019 Kerberos user ticket lifetime must be limited to 10 hours or less. + <VulnDiscussion>In Kerberos, there are two types of tickets: Ticket Granting Tickets (TGTs) and Service Tickets. Kerberos tickets have a limited lifetime so the time an attacker has to implement an attack is limited. This policy controls how long TGTs can be renewed. With Kerberos, the user's initial authentication to the domain controller results in a TGT, which is then used to request Service Tickets to resources. Upon startup, each computer gets a TGT before requesting a service ticket to the domain controller and any other computers it needs to access. For services that start up under a specified user account, users must always get a TGT first and then get Service Tickets to all computers and services accessed. + +Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001941 + CCI-001942 + Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Maximum lifetime for user ticket" to a maximum of "10" hours but not "0", which equates to "Ticket doesn't expire". + + + + This applies to domain controllers. It is NA for other systems. + +Verify the following is configured in the Default Domain Policy: + +Open "Group Policy Management". + +Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). + +Right-click on the "Default Domain Policy". + +Select "Edit". + +Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. + +If the value for "Maximum lifetime for user ticket" is "0" or greater than "10" hours, this is a finding. + + + + + SRG-OS-000112-GPOS-00057 + <GroupDescription></GroupDescription> + + WN19-DC-000050 + Windows Server 2019 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less. + <VulnDiscussion>This setting determines the period of time (in days) during which a user's Ticket Granting Ticket (TGT) may be renewed. This security configuration limits the amount of time an attacker has to crack the TGT and gain access. + +Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001941 + CCI-001942 + Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Maximum lifetime for user ticket renewal" to a maximum of "7" days or less. + + + + This applies to domain controllers. It is NA for other systems. + +Verify the following is configured in the Default Domain Policy: + +Open "Group Policy Management". + +Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). + +Right-click on the "Default Domain Policy". + +Select "Edit". + +Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. + +If the "Maximum lifetime for user ticket renewal" is greater than "7" days, this is a finding. + + + + + SRG-OS-000112-GPOS-00057 + <GroupDescription></GroupDescription> + + WN19-DC-000060 + Windows Server 2019 computer clock synchronization tolerance must be limited to five minutes or less. + <VulnDiscussion>This setting determines the maximum time difference (in minutes) that Kerberos will tolerate between the time on a client's clock and the time on a server's clock while still considering the two clocks synchronous. In order to prevent replay attacks, Kerberos uses timestamps as part of its protocol definition. For timestamps to work properly, the clocks of the client and the server need to be in sync as much as possible. + +Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001941 + CCI-001942 + Configure the policy value in the Default Domain Policy for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Maximum tolerance for computer clock synchronization" to a maximum of "5" minutes or less. + + + + This applies to domain controllers. It is NA for other systems. + +Verify the following is configured in the Default Domain Policy: + +Open "Group Policy Management". + +Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). + +Right-click on the "Default Domain Policy". + +Select "Edit". + +Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. + +If the "Maximum tolerance for computer clock synchronization" is greater than "5" minutes, this is a finding. + + + + + SRG-OS-000379-GPOS-00164 + <GroupDescription></GroupDescription> + + WN19-SO-000090 + Windows Server 2019 computer account password must not be prevented from being reset. + <VulnDiscussion>Computer account passwords are changed automatically on a regular basis. Disabling automatic password changes can make the system more vulnerable to malicious access. Frequent password changes can be a significant safeguard for the system. A new password for the computer account will be generated every 30 days.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001967 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Disable machine account password changes" to "Disabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: DisablePasswordChange + +Value Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000118-GPOS-00060 + <GroupDescription></GroupDescription> + + WN19-00-000190 + Windows Server 2019 outdated or unused accounts must be removed or disabled. + <VulnDiscussion>Outdated or unused accounts provide penetration points that may go undetected. Inactive accounts must be deleted if no longer necessary or, if still required, disabled until needed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000795 + Regularly review accounts to determine if they are still active. Remove or disable accounts that have not been used in the last 35 days. + + + + Open "Windows PowerShell". + +Domain Controllers: + +Enter "Search-ADAccount -AccountInactive -UsersOnly -TimeSpan 35.00:00:00" + +This will return accounts that have not been logged on to for 35 days, along with various attributes such as the Enabled status and LastLogonDate. + +Member servers and standalone systems: + +Copy or enter the lines below to the PowerShell window and enter. (Entering twice may be required. Do not include the quotes at the beginning and end of the query.) + +"([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach { + $user = ([ADSI]$_.Path) + $lastLogin = $user.Properties.LastLogin.Value + $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2 + if ($lastLogin -eq $null) { + $lastLogin = 'Never' + } + Write-Host $user.Name $lastLogin $enabled +}" + +This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False). +For example: User1 10/31/2015 5:49:56 AM True + +Review the list of accounts returned by the above queries to determine the finding validity for each account reported. + +Exclude the following accounts: + +- Built-in administrator account (Renamed, SID ending in 500) +- Built-in guest account (Renamed, Disabled, SID ending in 501) +- Application accounts + +If any enabled accounts have not been logged on to within the past 35 days, this is a finding. + +Inactive accounts that have been reviewed and deemed to be required must be documented with the ISSO. + + + + + SRG-OS-000078-GPOS-00046 + <GroupDescription></GroupDescription> + + WN19-00-000050 + Windows Server 2019 manually managed application account passwords must be at least 15 characters in length. + <VulnDiscussion>Application/service account passwords must be of sufficient length to prevent being easily cracked. Application/service accounts that are manually managed must have passwords at least 15 characters in length.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000205 + Establish a policy that requires application/service account passwords that are manually managed to be at least 15 characters in length. Ensure the policy is enforced. + + + + Determine if manually managed application/service accounts exist. If none exist, this is NA. + +Verify the organization has a policy to ensure passwords for manually managed application/service accounts are at least 15 characters in length. + +If such a policy does not exist or has not been implemented, this is a finding. + + + + + SRG-OS-000073-GPOS-00041 + <GroupDescription></GroupDescription> + + WN19-SO-000300 + Windows Server 2019 must be configured to prevent the storage of the LAN Manager hash of passwords. + <VulnDiscussion>The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords. This setting controls whether a LAN Manager hash of the password is stored in the SAM the next time the password is changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000196 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Do not store LAN Manager hash value on next password change" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: NoLMHash + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000074-GPOS-00042 + <GroupDescription></GroupDescription> + + WN19-SO-000180 + Windows Server 2019 unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers. + <VulnDiscussion>Some non-Microsoft SMB servers only support unencrypted (plain-text) password authentication. Sending plain-text passwords across the network when authenticating to an SMB server reduces the overall security of the environment. Check with the vendor of the SMB server to determine if there is a way to support encrypted password authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000197 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft Network Client: Send unencrypted password to third-party SMB servers" to "Disabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ + +Value Name: EnablePlainTextPassword + +Value Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000076-GPOS-00044 + <GroupDescription></GroupDescription> + + WN19-00-000020 + Windows Server 2019 passwords for the built-in Administrator account must be changed at least every 60 days. + <VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. The built-in Administrator account is not generally used and its password not may be changed as frequently as necessary. Changing the password for the built-in Administrator account on a regular basis will limit its exposure. + +Organizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every "30" days by default.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000199 + Change the built-in Administrator account password at least every "60" days. + +Automated tools, such as Microsoft's LAPS, may be used on domain-joined member servers to accomplish this. + + + + Review the password last set date for the built-in Administrator account. + +Domain controllers: + +Open "PowerShell". + +Enter "Get-ADUser -Filter * -Properties SID, PasswordLastSet | Where SID -Like "*-500" | Ft Name, SID, PasswordLastSet". + +If the "PasswordLastSet" date is greater than "60" days old, this is a finding. + +Member servers and standalone systems: + +Open "Command Prompt". + +Enter 'Net User [account name] | Find /i "Password Last Set"', where [account name] is the name of the built-in administrator account. + +(The name of the built-in Administrator account must be changed to something other than "Administrator" per STIG requirements.) + +If the "PasswordLastSet" date is greater than "60" days old, this is a finding. + + + + + SRG-OS-000076-GPOS-00044 + <GroupDescription></GroupDescription> + + WN19-00-000210 + Windows Server 2019 passwords must be configured to expire. + <VulnDiscussion>Passwords that do not expire or are reused increase the exposure of a password with greater probability of being discovered or cracked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000199 + Configure all enabled user account passwords to expire. + +Uncheck "Password never expires" for all enabled user accounts in Active Directory Users and Computers for domain accounts and Users in Computer Management for member servers and standalone systems. Document any exceptions with the ISSO. + + + + Review the password never expires status for enabled user accounts. + +Open "PowerShell". + +Domain Controllers: + +Enter "Search-ADAccount -PasswordNeverExpires -UsersOnly | FT Name, PasswordNeverExpires, Enabled". + +Exclude application accounts, disabled accounts (e.g., DefaultAccount, Guest) and the krbtgt account. + +If any enabled user accounts are returned with a "PasswordNeverExpires" status of "True", this is a finding. + +Member servers and standalone systems: + +Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordExpires=False and LocalAccount=True" | FT Name, PasswordExpires, Disabled, LocalAccount'. + +Exclude application accounts and disabled accounts (e.g., DefaultAccount, Guest). + +If any enabled user accounts are returned with a "PasswordExpires" status of "False", this is a finding. + + + + + SRG-OS-000066-GPOS-00034 + <GroupDescription></GroupDescription> + + WN19-DC-000280 + Windows Server 2019 domain controllers must have a PKI server certificate. + <VulnDiscussion>Domain controllers are part of the chain of trust for PKI authentications. Without the appropriate certificate, the authenticity of the domain controller cannot be verified. Domain controllers must have a server certificate to establish authenticity as part of PKI authentications in the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000185 + Obtain a server certificate for the domain controller. + + + + This applies to domain controllers. It is NA for other systems. + +Run "MMC". + +Select "Add/Remove Snap-in" from the "File" menu. + +Select "Certificates" in the left pane and click the "Add >" button. + +Select "Computer Account" and click "Next". + +Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish". + +Click "OK". + +Select and expand the Certificates (Local Computer) entry in the left pane. + +Select and expand the Personal entry in the left pane. + +Select the Certificates entry in the left pane. + +If no certificate for the domain controller exists in the right pane, this is a finding. + + + + + SRG-OS-000066-GPOS-00034 + <GroupDescription></GroupDescription> + + WN19-DC-000290 + Windows Server 2019 domain Controller PKI certificates must be issued by the DoD PKI or an approved External Certificate Authority (ECA). + <VulnDiscussion>A PKI implementation depends on the practices established by the Certificate Authority (CA) to ensure the implementation is secure. Without proper practices, the certificates issued by a CA have limited value in authentication functions. The use of multiple CAs from separate PKI implementations results in interoperability issues. If servers and clients do not have a common set of root CA certificates, they are not able to authenticate each other.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000185 + Obtain a server certificate for the domain controller issued by the DoD PKI or an approved ECA. + + + + This applies to domain controllers. It is NA for other systems. + +Run "MMC". + +Select "Add/Remove Snap-in" from the "File" menu. + +Select "Certificates" in the left pane and click the "Add >" button. + +Select "Computer Account" and click "Next". + +Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish". + +Click "OK". + +Select and expand the Certificates (Local Computer) entry in the left pane. + +Select and expand the Personal entry in the left pane. + +Select the Certificates entry in the left pane. + +In the right pane, examine the "Issued By" field for the certificate to determine the issuing CA. + +If the "Issued By" field of the PKI certificate being used by the domain controller does not indicate the issuing CA is part of the DoD PKI or an approved ECA, this is a finding. + +If the certificates in use are issued by a CA authorized by the Component's CIO, this is a CAT II finding. + +There are multiple sources from which lists of valid DoD CAs and approved ECAs can be obtained: + +The Global Directory Service (GDS) website provides an online source. The address for this site is https://crl.gds.disa.mil. + +DoD Public Key Enablement (PKE) Engineering Support maintains the InstallRoot utility to manage DoD supported root certificates on Windows computers, which includes a list of authorized CAs. The utility package can be downloaded from the PKI and PKE Tools page on IASE: + +http://iase.disa.mil/pki-pke/function_pages/tools.html + + + + + SRG-OS-000066-GPOS-00034 + <GroupDescription></GroupDescription> + + WN19-DC-000300 + Windows Server 2019 PKI certificates associated with user accounts must be issued by a DoD PKI or an approved External Certificate Authority (ECA). + <VulnDiscussion>A PKI implementation depends on the practices established by the Certificate Authority (CA) to ensure the implementation is secure. Without proper practices, the certificates issued by a CA have limited value in authentication functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000185 + Map user accounts to PKI certificates using the appropriate User Principal Name (UPN) for the network. See PKE documentation for details. + + + + This applies to domain controllers. It is NA for other systems. + +Review user account mappings to PKI certificates. + +Open "Windows PowerShell". + +Enter "Get-ADUser -Filter * | FT Name, UserPrincipalName, Enabled". + +Exclude disabled accounts (e.g., DefaultAccount, Guest) and the krbtgt account. + +If the User Principal Name (UPN) is not in the format of an individual's identifier for the certificate type and for the appropriate domain suffix, this is a finding. + +For standard NIPRNet certificates, the individual's identifier is in the format of an Electronic Data Interchange - Personnel Identifier (EDI-PI). + +Alt Tokens and other certificates may use a different UPN format than the EDI-PI which vary by organization. Verified these with the organization. + +NIPRNet Example: + +Name - User Principal Name +User1 - 1234567890@mil + +See PKE documentation for other network domain suffixes. + +If the mappings are to certificates issued by a CA authorized by the Component's CIO, this is a CAT II finding. + + + + + SRG-OS-000066-GPOS-00034 + <GroupDescription></GroupDescription> + + WN19-PK-000010 + Windows Server 2019 must have the DoD Root Certificate Authority (CA) certificates installed in the Trusted Root Store. + <VulnDiscussion>To ensure secure DoD websites and DoD-signed code are properly validated, the system must trust the DoD Root CAs. The DoD root certificates will ensure that the trust chain is established for server certificates issued from the DoD CAs. + +Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000185 + CCI-002470 + Install the DoD Root CA certificates: + +DoD Root CA 2 +DoD Root CA 3 +DoD Root CA 4 +DoD Root CA 5 + +The InstallRoot tool is available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx. + + + + The certificates and thumbprints referenced below apply to unclassified systems; see PKE documentation for other networks. + +Open "Windows PowerShell" as an administrator. + +Execute the following command: + +Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*DoD*" | FL Subject, Thumbprint, NotAfter + +If the following certificate "Subject" and "Thumbprint" information is not displayed, this is a finding. + +If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. + +Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561 +NotAfter: 12/5/2029 + +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB +NotAfter: 12/30/2029 + +Subject: CN=DoD Root CA 4, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026 +NotAfter: 7/25/2032 + +Subject: CN=DoD Root CA 5, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B +NotAfter: 6/14/2041 + +Alternately, use the Certificates MMC snap-in: + +Run "MMC". + +Select "File", "Add/Remove Snap-in". + +Select "Certificates" and click "Add". + +Select "Computer account" and click "Next". + +Select "Local computer: (the computer this console is running on)" and click "Finish". + +Click "OK". + +Expand "Certificates" and navigate to "Trusted Root Certification Authorities >> Certificates". + +For each of the DoD Root CA certificates noted below: + +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the DoD Root CA certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. + +DoD Root CA 2 +Thumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561 +Valid to: Wednesday, December 5, 2029 + +DoD Root CA 3 +Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB +Valid to: Sunday, December 30, 2029 + +DoD Root CA 4 +Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026 +Valid to: Sunday, July 25, 2032 + +DoD Root CA 5 +Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B +Valid to: Friday, June 14, 2041 + + + + + SRG-OS-000066-GPOS-00034 + <GroupDescription></GroupDescription> + + WN19-PK-000020 + Windows Server 2019 must have the DoD Interoperability Root Certificate Authority (CA) cross-certificates installed in the Untrusted Certificates Store on unclassified systems. + <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. + +Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000185 + CCI-002470 + Install the DoD Interoperability Root CA cross-certificates on unclassified systems. + +Issued To - Issued By - Thumbprint +DoD Root CA 2 - DoD Interoperability Root CA 1 - 22BBE981F0694D246CC1472ED2B021DC8540A22F + +DoD Root CA 3 - DoD Interoperability Root CA 2 - FFAD03329B9E527A43EEC66A56F9CBB5393E6E13 + +DoD Root CA 3 - DoD Interoperability Root CA 2 - FCE1B1E25374DD94F5935BEB86CA643D8C8D1FF4 + +Administrators should run the Federal Bridge Certification Authority (FBCA) Cross-Certificate Removal Tool once as an administrator and once as the current user. + +The FBCA Cross-Certificate Remover Tool and User Guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx. + + + + This is applicable to unclassified systems. It is NA for others. + +Open "PowerShell" as an administrator. + +Execute the following command: + +Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter + +If the following certificate "Subject", "Issuer", and "Thumbprint" information is not displayed, this is a finding. + +If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. + +Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F +NotAfter: 9/6/2019 + +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: FCE1B1E25374DD94F5935BEB86CA643D8C8D1FF4 +NotAfter: 2/17/2019 + +Alternately, use the Certificates MMC snap-in: + +Run "MMC". + +Select "File", "Add/Remove Snap-in". + +Select "Certificates" and click "Add". + +Select "Computer account" and click "Next". + +Select "Local computer: (the computer this console is running on)" and click "Finish". + +Click "OK". + +Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". + +For each certificate with "DoD Root CA..." under "Issued To" and "DoD Interoperability Root CA..." under "Issued By": + +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. + +Issued To: DoD Root CA 2 +Issued By: DoD Interoperability Root CA 1 +Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F +Valid to: Friday, September 6, 2019 + +Issued To: DoD Root CA 3 +Issued By: DoD Interoperability Root CA 2 +Thumbprint: FFAD03329B9E527A43EEC66A56F9CBB5393E6E13 +Valid to: Sunday, September 23, 2018 + +Issued To: DoD Root CA 3 +Issued By: DoD Interoperability Root CA 2 +Thumbprint: FCE1B1E25374DD94F5935BEB86CA643D8C8D1FF4 +Valid to: Sunday, February 17, 2019 + + + + + SRG-OS-000066-GPOS-00034 + <GroupDescription></GroupDescription> + + WN19-PK-000030 + Windows Server 2019 must have the US DoD CCEB Interoperability Root CA cross-certificates in the Untrusted Certificates Store on unclassified systems. + <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. + +Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000185 + CCI-002470 + Install the US DoD CCEB Interoperability Root CA cross-certificate on unclassified systems. + +Issued To - Issued By - Thumbprint +DoD Root CA 2 - US DoD CCEB Interoperability Root CA 1 - DA36FAF56B2F6FBA1604F5BE46D864C9FA013BA3 + +DoD Root CA 3 - US DoD CCEB Interoperability Root CA 2 - 929BF3196896994C0A201DF4A5B71F603FEFBF2E + +Administrators should run the Federal Bridge Certification Authority (FBCA) Cross-Certificate Removal Tool once as an administrator and once as the current user. + +The FBCA Cross-Certificate Remover Tool and User Guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx. + + + + This is applicable to unclassified systems. It is NA for others. + +Open "PowerShell" as an administrator. + +Execute the following command: + +Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter + +If the following certificate "Subject", "Issuer", and "Thumbprint" information is not displayed, this is a finding. + +If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. + +Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=US DoD CCEB Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: DA36FAF56B2F6FBA1604F5BE46D864C9FA013BA3 +NotAfter: 3/9/2019 + +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E +NotAfter: 9/27/2019 + +Alternately, use the Certificates MMC snap-in: + +Run "MMC". + +Select "File", "Add/Remove Snap-in". + +Select "Certificates" and click "Add". + +Select "Computer account" and click "Next". + +Select "Local computer: (the computer this console is running on)" and click "Finish". + +Click "OK". + +Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". + +For each certificate with "US DoD CCEB Interoperability Root CA ..." under "Issued By": + +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. + +Issued To: DoD Root CA 2 +Issued By: US DoD CCEB Interoperability Root CA 1 +Thumbprint: DA36FAF56B2F6FBA1604F5BE46D864C9FA013BA3 +Valid to: Saturday, March 9, 2019 + +Issued To: DoD Root CA 3 +Issuer by: US DoD CCEB Interoperability Root CA 2 +Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E +Valid: Friday, September 27, 2019 + + + + + SRG-OS-000067-GPOS-00035 + <GroupDescription></GroupDescription> + + WN19-SO-000350 + Windows Server 2019 users must be required to enter a password to access private keys stored on the computer. + <VulnDiscussion>If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure. + +The cornerstone of the PKI is the private key used to encrypt or digitally sign information. + +If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user. + +Both the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000186 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System cryptography: Force strong key protection for user keys stored on the computer" to "User must enter a password each time they use a key". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\ + +Value Name: ForceKeyProtection + +Type: REG_DWORD +Value: 0x00000002 (2) + + + + + SRG-OS-000120-GPOS-00061 + <GroupDescription></GroupDescription> + + WN19-SO-000290 + Windows Server 2019 Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites. + <VulnDiscussion>Certain encryption types are no longer considered secure. The DES and RC4 encryption suites must not be used for Kerberos encryption. + +Note: Organizations with domain controllers running earlier versions of Windows where RC4 encryption is enabled, selecting "The other domain supports Kerberos AES Encryption" on domain trusts, may be required to allow client communication across the trust relationship.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000803 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Configure encryption types allowed for Kerberos" to "Enabled" with only the following selected: + +AES128_HMAC_SHA1 +AES256_HMAC_SHA1 +Future encryption types + +Note: Organizations with domain controllers running earlier versions of Windows where RC4 encryption is enabled, selecting "The other domain supports Kerberos AES Encryption" on domain trusts, may be required to allow client communication across the trust relationship. + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\ + +Value Name: SupportedEncryptionTypes + +Value Type: REG_DWORD +Value: 0x7ffffff8 (2147483640) + + + + + SRG-OS-000393-GPOS-00173 + <GroupDescription></GroupDescription> + + WN19-CC-000480 + Windows Server 2019 Windows Remote Management (WinRM) client must not allow unencrypted traffic. + <VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this. + +Satisfies: SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002890 + CCI-003123 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Allow unencrypted traffic" to "Disabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ + +Value Name: AllowUnencryptedTraffic + +Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000393-GPOS-00173 + <GroupDescription></GroupDescription> + + WN19-CC-000510 + Windows Server 2019 Windows Remote Management (WinRM) service must not allow unencrypted traffic. + <VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this. + +Satisfies: SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002890 + CCI-003123 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Allow unencrypted traffic" to "Disabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ + +Value Name: AllowUnencryptedTraffic + +Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000125-GPOS-00065 + <GroupDescription></GroupDescription> + + WN19-CC-000470 + Windows Server 2019 Windows Remote Management (WinRM) client must not use Basic authentication. + <VulnDiscussion>Basic authentication uses plain-text passwords that could be used to compromise a system. Disabling Basic authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000877 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Allow Basic authentication" to "Disabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ + +Value Name: AllowBasic + +Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000125-GPOS-00065 + <GroupDescription></GroupDescription> + + WN19-CC-000490 + Windows Server 2019 Windows Remote Management (WinRM) client must not use Digest authentication. + <VulnDiscussion>Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks. Disallowing Digest authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000877 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Disallow Digest authentication" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ + +Value Name: AllowDigest + +Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000125-GPOS-00065 + <GroupDescription></GroupDescription> + + WN19-CC-000500 + Windows Server 2019 Windows Remote Management (WinRM) service must not use Basic authentication. + <VulnDiscussion>Basic authentication uses plain-text passwords that could be used to compromise a system. Disabling Basic authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000877 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Allow Basic authentication" to "Disabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ + +Value Name: AllowBasic + +Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000163-GPOS-00072 + <GroupDescription></GroupDescription> + + WN19-DC-000160 + Windows Server 2019 directory service must be configured to terminate LDAP-based network connections to the directory server after five minutes of inactivity. + <VulnDiscussion>The failure to terminate inactive network connections increases the risk of a successful attack on the directory server. The longer an established session is in progress, the more time an attacker has to hijack the session, implement a means to passively intercept data, or compromise any protections on client access. For example, if an attacker gains control of a client computer, an existing (already authenticated) session with the directory server could allow access to the directory. The lack of confidentiality protection in LDAP-based sessions increases exposure to this vulnerability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001133 + Configure the directory service to terminate LDAP-based network connections to the directory server after 5 minutes of inactivity. + +Open an elevated "Command prompt" (run as administrator). + +Enter "ntdsutil". + +At the "ntdsutil:" prompt, enter "LDAP policies". + +At the "ldap policy:" prompt, enter "connections". + +At the "server connections:" prompt, enter "connect to server [host-name]" (where [host-name] is the computer name of the domain controller). + +At the "server connections:" prompt, enter "q". + +At the "ldap policy:" prompt, enter "Set MaxConnIdleTime to 300". + +Enter "Commit Changes" to save. + +Enter "Show values" to verify changes. + +Enter "q" at the "ldap policy:" and "ntdsutil:" prompts to exit. + + + + This applies to domain controllers. It is NA for other systems. + +Open an elevated "Command Prompt" (run as administrator). + +Enter "ntdsutil". + +At the "ntdsutil:" prompt, enter "LDAP policies". + +At the "ldap policy:" prompt, enter "connections". + +At the "server connections:" prompt, enter "connect to server [host-name]" +(where [host-name] is the computer name of the domain controller). + +At the "server connections:" prompt, enter "q". + +At the "ldap policy:" prompt, enter "show values". + +If the value for MaxConnIdleTime is greater than "300" (5 minutes) or is not specified, this is a finding. + +Enter "q" at the "ldap policy:" and "ntdsutil:" prompts to exit. + +Alternately, Dsquery can be used to display MaxConnIdleTime: + +Open "Command Prompt (Admin)". +Enter the following command (on a single line). + +dsquery * "cn=Default Query Policy,cn=Query-Policies,cn=Directory Service, cn=Windows NT,cn=Services,cn=Configuration,dc=[forest-name]" -attr LDAPAdminLimits + +The quotes are required and dc=[forest-name] is the fully qualified LDAP name of the domain being reviewed (e.g., dc=disaost,dc=mil). + +If the results do not specify a "MaxConnIdleTime" or it has a value greater than "300" (5 minutes), this is a finding. + + + + + SRG-OS-000478-GPOS-00223 + <GroupDescription></GroupDescription> + + WN19-SO-000360 + Windows Server 2019 must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing. + <VulnDiscussion>This setting ensures the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing. FIPS-compliant algorithms meet specific standards established by the U.S. Government and must be the algorithms used for all OS encryption functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002450 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy\ + +Value Name: Enabled + +Value Type: REG_DWORD +Value: 0x00000001 (1) + +Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms. Both the browser and web server must be configured to use TLS; otherwise. the browser will not be able to connect to a secure site. + + + + + SRG-OS-000396-GPOS-00176 + <GroupDescription></GroupDescription> + + WN19-DC-000140 + Windows Server 2019 must use separate, NSA-approved (Type 1) cryptography to protect the directory data in transit for directory service implementations at a classified confidentiality level when replication data traverses a network cleared to a lower level than the data. + <VulnDiscussion>Directory data that is not appropriately encrypted is subject to compromise. Commercial-grade encryption does not provide adequate protection when the classification level of directory data in transit is higher than the level of the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002450 + Configure NSA-approved (Type 1) cryptography to protect the directory data in transit for directory service implementations at a classified confidentiality level that transfer replication data through a network cleared to a lower level than the data. + + + + This applies to domain controllers. It is NA for other systems. + +Review the organization network diagram(s) or documentation to determine the level of classification for the network(s) over which replication data is transmitted. + +Determine the classification level of the Windows domain controller. + +If the classification level of the Windows domain controller is higher than the level of the networks, review the organization network diagram(s) and directory implementation documentation to determine if NSA-approved encryption is used to protect the replication network traffic. + +If the classification level of the Windows domain controller is higher than the level of the network traversed and NSA-approved encryption is not used, this is a finding. + + + + + SRG-OS-000185-GPOS-00079 + <GroupDescription></GroupDescription> + + WN19-00-000250 + Windows Server 2019 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. + <VulnDiscussion>This requirement addresses protection of user-generated data as well as operating system-specific configuration data. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate, in accordance with the security category and/or classification of the information. + +Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields). + +Satisfies: SRG-OS-000185-GPOS-00079, SRG-OS-000404-GPOS-00183, SRG-OS-000405-GPOS-00184</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001199 + CCI-002475 + CCI-002476 + Configure systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data to employ encryption to protect the confidentiality and integrity of all information at rest. + + + + Verify systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data employ encryption to protect the confidentiality and integrity of all information at rest. + +If they do not, this is a finding. + + + + + SRG-OS-000134-GPOS-00068 + <GroupDescription></GroupDescription> + + WN19-CC-000240 + Windows Server 2019 administrator accounts must not be enumerated during elevation. + <VulnDiscussion>Enumeration of administrator accounts when elevating can provide part of the logon information to an unauthorized user. This setting configures the system to always require users to type in a username and password to elevate a running application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001084 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Credential User Interface >> "Enumerate administrator accounts on elevation" to "Disabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\ + +Value Name: EnumerateAdministrators + +Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000134-GPOS-00068 + <GroupDescription></GroupDescription> + + WN19-SO-000390 + Windows Server 2019 UIAccess applications must not be allowed to prompt for elevation without using the secure desktop. + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting prevents User Interface Accessibility programs from disabling the secure desktop for elevation prompts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001084 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop" to "Disabled". + + + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableUIADesktopToggle + +Value Type: REG_DWORD +Value: 0x00000000 (0) + + + + + SRG-OS-000134-GPOS-00068 + <GroupDescription></GroupDescription> + + WN19-SO-000400 + Windows Server 2019 User Account Control must, at a minimum, prompt administrators for consent on the secure desktop. + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the elevation requirements for logged-on administrators to complete a task that requires raised privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001084 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Prompt for consent on the secure desktop". + +The more secure option for this setting, "Prompt for credentials on the secure desktop", would also be acceptable. + + + + UAC requirements are NA for Server Core installations (this is default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: ConsentPromptBehaviorAdmin + +Value Type: REG_DWORD +Value: 0x00000002 (2) (Prompt for consent on the secure desktop) +0x00000001 (1) (Prompt for credentials on the secure desktop) + + + + + SRG-OS-000134-GPOS-00068 + <GroupDescription></GroupDescription> + + WN19-SO-000420 + Windows Server 2019 User Account Control must be configured to detect application installations and prompt for elevation. + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting requires Windows to respond to application installation requests by prompting for credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001084 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Detect application installations and prompt for elevation" to "Enabled". + + + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableInstallerDetection + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000134-GPOS-00068 + <GroupDescription></GroupDescription> + + WN19-SO-000430 + Windows Server 2019 User Account Control (UAC) must only elevate UIAccess applications that are installed in secure locations. + <VulnDiscussion>UAC is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures Windows to only allow applications installed in a secure location on the file system, such as the Program Files or the Windows\System32 folders, to run with elevated privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001084 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Only elevate UIAccess applications that are installed in secure locations" to "Enabled". + + + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableSecureUIAPaths + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000134-GPOS-00068 + <GroupDescription></GroupDescription> + + WN19-SO-000450 + Windows Server 2019 User Account Control (UAC) must virtualize file and registry write failures to per-user locations. + <VulnDiscussion>UAC is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures non-UAC-compliant applications to run in virtualized file and registry entries in per-user locations, allowing them to run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001084 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Virtualize file and registry write failures to per-user locations" to "Enabled". + + + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableVirtualization + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000138-GPOS-00069 + <GroupDescription></GroupDescription> + + WN19-00-000230 + Windows Server 2019 non-system-created file shares must limit access to groups that require it. + <VulnDiscussion>Shares on a system provide network access. To prevent exposing sensitive information, where shares are necessary, permissions must be reconfigured to give the minimum access to accounts that require it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001090 + If a non-system-created share is required on a system, configure the share and NTFS permissions to limit access to the specific groups or accounts that require it. + +Remove any unnecessary non-system-created shares. + + + + If only system-created shares such as "ADMIN$", "C$", and "IPC$" exist on the system, this is NA. (System-created shares will display a message that it has been shared for administrative purposes when "Properties" is selected.) + +Run "Computer Management". + +Navigate to System Tools >> Shared Folders >> Shares. + +Right-click any non-system-created shares. + +Select "Properties". + +Select the "Share Permissions" tab. + +If the file shares have not been configured to restrict permissions to the specific groups or accounts that require access, this is a finding. + +Select the "Security" tab. + +If the permissions have not been configured to restrict permissions to the specific groups or accounts that require access, this is a finding. + + + + + SRG-OS-000138-GPOS-00069 + <GroupDescription></GroupDescription> + + WN19-CC-000350 + Windows Server 2019 Remote Desktop Services must prevent drive redirection. + <VulnDiscussion>Preventing users from sharing the local drives on their client computers with Remote Session Hosts that they access helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001090 + Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Device and Resource Redirection >> "Do not allow drive redirection" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fDisableCdm + +Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000138-GPOS-00069 + <GroupDescription></GroupDescription> + + WN19-DC-000120 + Windows Server 2019 data files owned by users must be on a different logical partition from the directory server data files. + <VulnDiscussion>When directory service data files, especially for directories used for identification, authentication, or authorization, reside on the same logical partition as user-owned files, the directory service data may be more vulnerable to unauthorized access or other availability compromises. Directory service and user-owned data files sharing a partition may be configured with less restrictive permissions in order to allow access to the user data. + +The directory service may be vulnerable to a denial of service attack when user-owned files on a common partition are expanded to an extent preventing the directory service from acquiring more space for directory or audit data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001090 + Move shares used to store files owned by users to a different logical partition than the directory server data files. + + + + This applies to domain controllers. It is NA for other systems. + +Run "Regedit". + +Navigate to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters". + +Note the directory locations in the values for "DSA Database file". + +Open "Command Prompt". + +Enter "net share". + +Note the logical drive(s) or file system partition for any organization-created data shares. + +Ignore system shares (e.g., NETLOGON, SYSVOL, and administrative shares ending in $). User shares that are hidden (ending with $) should not be ignored. + +If user shares are located on the same logical partition as the directory server data files, this is a finding. + + + + + SRG-OS-000138-GPOS-00069 + <GroupDescription></GroupDescription> + + WN19-SO-000230 + Windows Server 2019 must not allow anonymous enumeration of shares. + <VulnDiscussion>Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001090 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Do not allow anonymous enumeration of SAM accounts and shares" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: RestrictAnonymous + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000138-GPOS-00069 + <GroupDescription></GroupDescription> + + WN19-SO-000250 + Windows Server 2019 must restrict anonymous access to Named Pipes and Shares. + <VulnDiscussion>Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access. This setting restricts access to those defined in "Network access: Named Pipes that can be accessed anonymously" and "Network access: Shares that can be accessed anonymously", both of which must be blank under other requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001090 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Restrict anonymous access to Named Pipes and Shares" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: RestrictNullSessAccess + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000420-GPOS-00186 + <GroupDescription></GroupDescription> + + WN19-CC-000060 + Windows Server 2019 must be configured to ignore NetBIOS name release requests except from WINS servers. + <VulnDiscussion>Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the server's WINS resolution capability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002385 + Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers" to "Enabled". + +This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively. + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netbt\Parameters\ + +Value Name: NoNameReleaseOnDemand + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000425-GPOS-00189 + <GroupDescription></GroupDescription> + + WN19-00-000260 + Windows Server 2019 must implement protection methods such as TLS, encrypted VPNs, or IPsec if the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. + <VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. + +Ensuring the confidentiality of transmitted information requires the operating system to take measures in preparing information for transmission. This can be accomplished via access control and encryption. + +Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, operating systems need to support transmission protection mechanisms such as TLS, encrypted VPNs, or IPsec. + +Satisfies: SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002420 + CCI-002422 + Configure protection methods such as TLS, encrypted VPNs, or IPsec when the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. + + + + If the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, verify protection methods such as TLS, encrypted VPNs, or IPsec have been implemented. + +If protection methods have not been implemented, this is a finding. + + + + + SRG-OS-000423-GPOS-00187 + <GroupDescription></GroupDescription> + + WN19-DC-000320 + Windows Server 2019 domain controllers must require LDAP access signing. + <VulnDiscussion>Unsigned network traffic is susceptible to man-in-the-middle attacks, where an intruder captures packets between the server and the client and modifies them before forwarding them to the client. In the case of an LDAP server, this means that an attacker could cause a client to make decisions based on false records from the LDAP directory. The risk of an attacker pulling this off can be decreased by implementing strong physical security measures to protect the network infrastructure. Furthermore, implementing Internet Protocol security (IPsec) authentication header mode (AH), which performs mutual authentication and packet integrity for Internet Protocol (IP) traffic, can make all types of man-in-the-middle attacks extremely difficult. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002418 + CCI-002421 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain controller: LDAP server signing requirements" to "Require signing". + + + + This applies to domain controllers. It is NA for other systems. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\NTDS\Parameters\ + +Value Name: LDAPServerIntegrity + +Value Type: REG_DWORD +Value: 0x00000002 (2) + + + + + SRG-OS-000423-GPOS-00187 + <GroupDescription></GroupDescription> + + WN19-SO-000060 + Windows Server 2019 setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled. + <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted and signed. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002418 + CCI-002421 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally encrypt or sign secure channel data (always)" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: RequireSignOrSeal + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000423-GPOS-00187 + <GroupDescription></GroupDescription> + + WN19-SO-000070 + Windows Server 2019 setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to enabled. + <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002418 + CCI-002421 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally encrypt secure channel data (when possible)" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: SealSecureChannel + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000423-GPOS-00187 + <GroupDescription></GroupDescription> + + WN19-SO-000080 + Windows Server 2019 setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled. + <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked. If this policy is enabled, outgoing secure channel traffic will be signed. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002418 + CCI-002421 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally sign secure channel data (when possible)" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: SignSecureChannel + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000423-GPOS-00187 + <GroupDescription></GroupDescription> + + WN19-SO-000110 + Windows Server 2019 must be configured to require a strong session key. + <VulnDiscussion>A computer connecting to a domain controller will establish a secure channel. The secure channel connection may be subject to compromise, such as hijacking or eavesdropping, if strong session keys are not used to establish the connection. Requiring strong session keys enforces 128-bit encryption between systems. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002418 + CCI-002421 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Require strong (Windows 2000 or Later) session key" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: RequireStrongKey + +Value Type: REG_DWORD +Value: 0x00000001 (1) + +This setting may prevent a system from being joined to a domain if not configured consistently between systems. + + + + + SRG-OS-000423-GPOS-00187 + <GroupDescription></GroupDescription> + + WN19-SO-000160 + Windows Server 2019 setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled. + <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002418 + CCI-002421 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network client: Digitally sign communications (always)" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ + +Value Name: RequireSecuritySignature + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000423-GPOS-00187 + <GroupDescription></GroupDescription> + + WN19-SO-000170 + Windows Server 2019 setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled. + <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. If this policy is enabled, the SMB client will request packet signing when communicating with an SMB server that is enabled or required to perform SMB packet signing. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002418 + CCI-002421 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network client: Digitally sign communications (if server agrees)" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ + +Value Name: EnableSecuritySignature + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000423-GPOS-00187 + <GroupDescription></GroupDescription> + + WN19-SO-000190 + Windows Server 2019 setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled. + <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002418 + CCI-002421 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network server: Digitally sign communications (always)" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: RequireSecuritySignature + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000423-GPOS-00187 + <GroupDescription></GroupDescription> + + WN19-SO-000200 + Windows Server 2019 setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled. + <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will negotiate SMB packet signing as requested by the client. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002418 + CCI-002421 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network server: Digitally sign communications (if client agrees)" to "Enabled". + + + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: EnableSecuritySignature + +Value Type: REG_DWORD +Value: 0x00000001 (1) + + + + + SRG-OS-000433-GPOS-00192 + <GroupDescription></GroupDescription> + + WN19-CC-000310 + Windows Server 2019 Explorer Data Execution Prevention must be enabled. + <VulnDiscussion>Data Execution Prevention provides additional protection by performing checks on memory to help prevent malicious code from running. This setting will prevent Data Execution Prevention from being turned off for File Explorer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002824 + The default behavior is for data execution prevention to be turned on for File Explorer. + +If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Turn off Data Execution Prevention for Explorer" to "Not Configured" or "Disabled". + + + + The default behavior is for Data Execution Prevention to be turned on for File Explorer. + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ + +Value Name: NoDataExecutionPrevention + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist) + + + + + SRG-OS-000433-GPOS-00193 + <GroupDescription></GroupDescription> + + WN19-EP-000020 + Windows Server 2019 Exploit Protection system-level mitigation, Randomize memory allocations (Bottom-Up ASLR), must be on. + <VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Randomize memory allocations (Bottom-Up ASLR)", are enabled by default at the system level. Bottom-Up ASLR (address space layout randomization) randomizes locations for virtual memory allocations, including those for system structures. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002824 + Ensure Exploit Protection system-level mitigation, "Randomize memory allocations (Bottom-Up ASLR)" is turned on. The default configuration in Exploit Protection is "On by default" which meets this requirement. + +Open "Windows Defender Security Center". + +Select "App & browser control". + +Select "Exploit protection settings". + +Under "System settings", configure "Randomize memory allocations (Bottom-Up ASLR)" to "On by default" or "Use default (<On>)". + +The STIG package includes a DoD EP XML file in the "Supporting Files" folder for configuring application mitigations defined in the STIG. This can also be modified to explicitly enforce the system level requirements. Adding the following to the XML file will explicitly turn Bottom-Up ASLR on (other system level EP requirements can be combined under <SystemConfig>): + +<SystemConfig> + <ASLR BottomUp="true" HighEntropy="true"></ASLR> +</SystemConfig> + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location. + + + + This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "ASLR: BottomUp" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration) + + + + + SRG-OS-000191-GPOS-00080 + <GroupDescription></GroupDescription> + + WN19-00-000290 + Windows Server 2019 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where Host Based Security System (HBSS) is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP). + <VulnDiscussion>Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. The operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-001233 + Install a DoD approved HBSS software and ensure it is operating continuously. + + + + Verify DoD approved HBSS software is installed, configured, and properly operating. Ask the operator to document the HBSS software installation and configuration. + +If the operator is not able to provide a documented configuration for an installed HBSS or if the HBSS software is not properly configured, maintained, or used, this is a finding. + + + + + SRG-OS-000480-GPOS-00231 + <GroupDescription></GroupDescription> + + WN19-00-000280 + Windows Server 2019 must have a host-based firewall installed and enabled. + <VulnDiscussion>A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + CCI-002080 + Install and enable a host-based firewall on the system. + + + + Determine if a host-based firewall is installed and enabled on the system. + +If a host-based firewall is not installed and enabled on the system, this is a finding. + +The configuration requirements will be determined by the applicable firewall STIG. + + + + + SRG-OS-000297-GPOS-00115 + <GroupDescription></GroupDescription> + + WN19-DC-000410 + Windows Server 2019 Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on through Remote Desktop Services" user right defines the accounts that are prevented from logging on using Remote Desktop Services. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002314 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on through Remote Desktop Services" to include the following: + +- Guests Group + + + + This applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on through Remote Desktop Services" user right, this is a finding: + +- Guests Group + + + + + + + SRG-OS-000080-GPOS-00048 + <GroupDescription></GroupDescription> + + WN19-DC-000340 + Windows Server 2019 Access this computer from the network user right must only be assigned to the Administrators, Authenticated Users, and +Enterprise Domain Controllers groups on domain controllers. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Access this computer from the network" right may access resources on the system, and this right must be limited to those requiring it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000213 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Access this computer from the network" to include only the following accounts or groups: + +- Administrators +- Authenticated Users +- Enterprise Domain Controllers + + + + This applies to domain controllers. It is NA for other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Access this computer from the network" right, this is a finding. + +- Administrators +- Authenticated Users +- Enterprise Domain Controllers + + + + + + + SRG-OS-000080-GPOS-00048 + <GroupDescription></GroupDescription> + + WN19-DC-000360 + Windows Server 2019 Allow log on through Remote Desktop Services user right must only be assigned to the Administrators group on domain controllers. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Allow log on through Remote Desktop Services" user right can access a system through Remote Desktop.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000213 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Allow log on through Remote Desktop Services" to include only the following accounts or groups: + +- Administrators + + + + This applies to domain controllers, it is NA for other systems. + +Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Allow log on through Remote Desktop Services" user right, this is a finding. + +- Administrators + + + + + + + SRG-OS-000080-GPOS-00048 + <GroupDescription></GroupDescription> + + WN19-DC-000370 + Windows Server 2019 Deny access to this computer from the network user right on domain controllers must be configured to prevent unauthenticated access. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny access to this computer from the network" user right defines the accounts that are prevented from logging on from the network. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000213 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny access to this computer from the network" to include the following: + +- Guests Group + + + + This applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny access to this computer from the network" user right, this is a finding: + +- Guests Group + + + + + + + SRG-OS-000080-GPOS-00048 + <GroupDescription></GroupDescription> + + WN19-DC-000380 + Windows Server 2019 Deny log on as a batch job user right on domain controllers must be configured to prevent unauthenticated access. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on as a batch job" user right defines accounts that are prevented from logging on to the system as a batch job, such as Task Scheduler. + +The Guests group must be assigned to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000213 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on as a batch job" to include the following: + +- Guests Group + + + + This applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on as a batch job" user right, this is a finding: + +- Guests Group + + + + + + + SRG-OS-000080-GPOS-00048 + <GroupDescription></GroupDescription> + + WN19-DC-000390 + Windows Server 2019 Deny log on as a service user right must be configured to include no accounts or groups (blank) on domain controllers. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on as a service" user right defines accounts that are denied logon as a service. + +Incorrect configurations could prevent services from starting and result in a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000213 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on as a service" to include no entries (blank). + + + + This applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are defined for the "Deny log on as a service" user right, this is a finding. + + + + + + + SRG-OS-000080-GPOS-00048 + <GroupDescription></GroupDescription> + + WN19-DC-000400 + Windows Server 2019 Deny log on locally user right on domain controllers must be configured to prevent unauthenticated access. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on locally" user right defines accounts that are prevented from logging on interactively. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000213 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on locally" to include the following: + +- Guests Group + + + + This applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on locally" user right, this is a finding: + +- Guests Group + + + + + + + SRG-OS-000080-GPOS-00048 + <GroupDescription></GroupDescription> + + WN19-UR-000030 + Windows Server 2019 Allow log on locally user right must only be assigned to the Administrators group. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Allow log on locally" user right can log on interactively to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000213 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Allow log on locally" to include only the following accounts or groups: + +- Administrators + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Allow log on locally" user right, this is a finding: + +- Administrators + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-DC-000350 + Windows Server 2019 Add workstations to domain user right must only be assigned to the Administrators group on domain controllers. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Add workstations to domain" right may add computers to a domain. This could result in unapproved or incorrectly configured systems being added to a domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Add workstations to domain" to include only the following accounts or groups: + +- Administrators + + + + This applies to domain controllers. It is NA for other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Add workstations to domain" right, this is a finding. + +- Administrators + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-DC-000420 + Windows Server 2019 Enable computer and user accounts to be trusted for delegation user right must only be assigned to the Administrators group on domain controllers. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Enable computer and user accounts to be trusted for delegation" user right allows the "Trusted for Delegation" setting to be changed. This could allow unauthorized users to impersonate other users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Enable computer and user accounts to be trusted for delegation" to include only the following accounts or groups: + +- Administrators + + + + This applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Enable computer and user accounts to be trusted for delegation" user right, this is a finding. + +- Administrators + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000010 + Windows Server 2019 Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Access Credential Manager as a trusted caller" user right may be able to retrieve the credentials of other accounts from Credential Manager.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Access Credential Manager as a trusted caller" to be defined but containing no entries (blank). + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Access Credential Manager as a trusted caller" user right, this is a finding. + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000020 + Windows Server 2019 Act as part of the operating system user right must not be assigned to any groups or accounts. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Act as part of the operating system" user right can assume the identity of any user and gain access to resources that the user is authorized to access. Any accounts with this right can take complete control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Act as part of the operating system" to be defined but containing no entries (blank). + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups (to include administrators), are granted the "Act as part of the operating system" user right, this is a finding. + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000040 + Windows Server 2019 Back up files and directories user right must only be assigned to the Administrators group. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Back up files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Back up files and directories" to include only the following accounts or groups: + +- Administrators + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Back up files and directories" user right, this is a finding: + +- Administrators + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000050 + Windows Server 2019 Create a pagefile user right must only be assigned to the Administrators group. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create a pagefile" user right can change the size of a pagefile, which could affect system performance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a pagefile" to include only the following accounts or groups: + +- Administrators + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Create a pagefile" user right, this is a finding: + +- Administrators + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000060 + Windows Server 2019 Create a token object user right must not be assigned to any groups or accounts. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Create a token object" user right allows a process to create an access token. This could be used to provide elevated rights and compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a token object" to be defined but containing no entries (blank). + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Create a token object" user right, this is a finding. + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000070 + Windows Server 2019 Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create global objects" user right can create objects that are available to all sessions, which could affect processes in other users' sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create global objects" to include only the following accounts or groups: + +- Administrators +- Service +- Local Service +- Network Service + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Create global objects" user right, this is a finding: + +- Administrators +- Service +- Local Service +- Network Service + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000080 + Windows Server 2019 Create permanent shared objects user right must not be assigned to any groups or accounts. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create permanent shared objects" user right could expose sensitive data by creating shared objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create permanent shared objects" to be defined but containing no entries (blank). + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Create permanent shared objects" user right, this is a finding. + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000090 + Windows Server 2019 Create symbolic links user right must only be assigned to the Administrators group. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create symbolic links" user right can create pointers to other objects, which could expose the system to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create symbolic links" to include only the following accounts or groups: + +- Administrators + +Systems that have the Hyper-V role will also have "Virtual Machines" given this user right. If this needs to be added manually, enter it as "NT Virtual Machine\Virtual Machines". + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Create symbolic links" user right, this is a finding: + +- Administrators + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000100 + Windows Server 2019 Debug programs: user right must only be assigned to the Administrators group. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Debug programs" user right can attach a debugger to any process or to the kernel, providing complete access to sensitive and critical operating system components. This right is given to Administrators in the default configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Debug programs" to include only the following accounts or groups: + +- Administrators + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Debug programs" user right, this is a finding: + +- Administrators + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000110 + Windows Server 2019 Force shutdown from a remote system user right must only be assigned to the Administrators group. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Force shutdown from a remote system" user right can remotely shut down a system, which could result in a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Force shutdown from a remote system" to include only the following accounts or groups: + +- Administrators + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Force shutdown from a remote system" user right, this is a finding: + +- Administrators + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000120 + Windows Server 2019 Generate security audits user right must only be assigned to Local Service and Network Service. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Generate security audits" user right specifies users and processes that can generate Security Log audit records, which must only be the system service accounts defined.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Generate security audits" to include only the following accounts or groups: + +- Local Service +- Network Service + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Generate security audits" user right, this is a finding: + +- Local Service +- Network Service + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000130 + Windows Server 2019 Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Impersonate a client after authentication" user right allows a program to impersonate another user or account to run on their behalf. An attacker could use this to elevate privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Impersonate a client after authentication" to include only the following accounts or groups: + +- Administrators +- Service +- Local Service +- Network Service + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Impersonate a client after authentication" user right, this is a finding: + +- Administrators +- Service +- Local Service +- Network Service + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000140 + Windows Server 2019 Increase scheduling priority: user right must only be assigned to the Administrators group. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Increase scheduling priority" user right can change a scheduling priority, causing performance issues or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Increase scheduling priority" to include only the following accounts or groups: + +- Administrators + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Increase scheduling priority" user right, this is a finding: + +- Administrators + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000150 + Windows Server 2019 Load and unload device drivers user right must only be assigned to the Administrators group. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Load and unload device drivers" user right allows a user to load device drivers dynamically on a system. This could be used by an attacker to install malicious code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Load and unload device drivers" to include only the following accounts or groups: + +- Administrators + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Load and unload device drivers" user right, this is a finding: + +- Administrators + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000160 + Windows Server 2019 Lock pages in memory user right must not be assigned to any groups or accounts. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Lock pages in memory" user right allows physical memory to be assigned to processes, which could cause performance issues or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Lock pages in memory" to be defined but containing no entries (blank). + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Lock pages in memory" user right, this is a finding. + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000180 + Windows Server 2019 Modify firmware environment values user right must only be assigned to the Administrators group. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Modify firmware environment values" user right can change hardware configuration environment variables. This could result in hardware failures or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Modify firmware environment values" to include only the following accounts or groups: + +- Administrators + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Modify firmware environment values" user right, this is a finding: + +- Administrators + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000190 + Windows Server 2019 Perform volume maintenance tasks user right must only be assigned to the Administrators group. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Perform volume maintenance tasks" user right can manage volume and disk configurations. This could be used to delete volumes, resulting in data loss or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Perform volume maintenance tasks" to include only the following accounts or groups: + +- Administrators + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Perform volume maintenance tasks" user right, this is a finding: + +- Administrators + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000200 + Windows Server 2019 Profile single process user right must only be assigned to the Administrators group. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Profile single process" user right can monitor non-system processes performance. An attacker could use this to identify processes to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Profile single process" to include only the following accounts or groups: + +- Administrators + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Profile single process" user right, this is a finding: + +- Administrators + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000210 + Windows Server 2019 Restore files and directories user right must only be assigned to the Administrators group. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Restore files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data. It could also be used to overwrite more current data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Restore files and directories" to include only the following accounts or groups: + +- Administrators + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Restore files and directories" user right, this is a finding: + +- Administrators + + + + + + + SRG-OS-000324-GPOS-00125 + <GroupDescription></GroupDescription> + + WN19-UR-000220 + Windows Server 2019 Take ownership of files or other objects user right must only be assigned to the Administrators group. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Take ownership of files or other objects" user right can take ownership of objects and make changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002235 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Take ownership of files or other objects" to include only the following accounts or groups: + +- Administrators + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Take ownership of files or other objects" user right, this is a finding: + +- Administrators + + + + + + + SRG-OS-000021-GPOS-00005 + <GroupDescription></GroupDescription> + + WN19-AC-000020 + Windows Server 2019 must have the number of allowed bad logon attempts configured to three or less. + <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack while allowing for honest errors made during normal user logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000044 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout threshold" to "3" or fewer invalid logon attempts (excluding "0", which is unacceptable). + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. + +If the "Account lockout threshold" is "0" or more than "3" attempts, this is a finding. + + + + + + + SRG-OS-000021-GPOS-00005 + <GroupDescription></GroupDescription> + + WN19-AC-000030 + Windows Server 2019 must have the period of time before the bad logon counter is reset configured to 15 minutes or greater. + <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to "0". The smaller this value is, the less effective the account lockout feature will be in protecting the local system. + +Satisfies: SRG-OS-000021-GPOS-00005, SRG-OS-000329-GPOS-00128</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000044 + CCI-002238 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Reset account lockout counter after" to at least "15" minutes. + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. + +If the "Reset account lockout counter after" value is less than "15" minutes, this is a finding. + + + + + + + SRG-OS-000329-GPOS-00128 + <GroupDescription></GroupDescription> + + WN19-AC-000010 + Windows Server 2019 account lockout duration must be configured to 15 minutes or greater. + <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that an account will remain locked after the specified number of failed logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-002238 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout duration" to "15" minutes or greater. + +A value of "0" is also acceptable, requiring an administrator to unlock the account. + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. + +If the "Account lockout duration" is less than "15" minutes (excluding "0"), this is a finding. + + + + + + + SRG-OS-000057-GPOS-00027 + <GroupDescription></GroupDescription> + + WN19-UR-000170 + Windows Server 2019 Manage auditing and security log user right must only be assigned to the Administrators group. + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Manage auditing and security log" user right can manage the security log and change auditing configurations. This could be used to clear evidence of tampering. + +Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000063-GPOS-00032, SRG-OS-000337-GPOS-00129</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000162 + CCI-000163 + CCI-000164 + CCI-000171 + CCI-001914 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Manage auditing and security log" to include only the following accounts or groups: + +- Administrators + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Manage auditing and security log" user right, this is a finding. + +- Administrators + + + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-00-000450 + Windows Server 2019 must have orphaned security identifiers (SIDs) removed from user rights. + <VulnDiscussion>Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups. If the account or group objects are reanimated, there is a potential they may still have rights no longer intended. Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Remove any unresolved SIDs found in User Rights assignments and determined to not be for currently valid accounts or groups by removing the accounts or groups from the appropriate group policy. + + + + Review the effective User Rights setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format that begins with "*S-1-".) + +If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding. + + + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-SO-000030 + Windows Server 2019 built-in administrator account must be renamed. + <VulnDiscussion>The built-in administrator account is a well-known account subject to attack. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Rename administrator account" to a name other than "Administrator". + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. + +If the value for "Accounts: Rename administrator account" is not set to a value other than "Administrator", this is a finding. + + + + + + + SRG-OS-000480-GPOS-00227 + <GroupDescription></GroupDescription> + + WN19-SO-000040 + Windows Server 2019 built-in guest account must be renamed. + <VulnDiscussion>The built-in guest account is a well-known user account on all Windows systems and, as initially installed, does not require a password. This can allow access to system resources by unauthorized users. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000366 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Rename guest account" to a name other than "Guest". + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. + +If the value for "Accounts: Rename guest account" is not set to a value other than "Guest", this is a finding. + + + + + + + SRG-OS-000069-GPOS-00037 + <GroupDescription></GroupDescription> + + WN19-AC-000080 + Windows Server 2019 must have the built-in Windows password complexity policy enabled. + <VulnDiscussion>The use of complex passwords increases their strength against attack. The built-in Windows password complexity policy requires passwords to contain at least three of the four types of characters (numbers, uppercase and lowercase letters, and special characters) and prevents the inclusion of user names or parts of user names. + +Satisfies: SRG-OS-000069-GPOS-00037, SRG-OS-000070-GPOS-00038, SRG-OS-000071-GPOS-00039, SRG-OS-000266-GPOS-00101</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000192 + CCI-000193 + CCI-000194 + CCI-001619 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Password must meet complexity requirements" to "Enabled". + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for "Password must meet complexity requirements" is not set to "Enabled", this is a finding. + + + + + + + SRG-OS-000078-GPOS-00046 + <GroupDescription></GroupDescription> + + WN19-AC-000070 + Windows Server 2019 minimum password length must be configured to 14 characters. + <VulnDiscussion>Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system and compromising the device, information, or the local network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000205 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Minimum password length" to "14" characters. + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for the "Minimum password length," is less than "14" characters, this is a finding. + + + + + + + SRG-OS-000073-GPOS-00041 + <GroupDescription></GroupDescription> + + WN19-AC-000090 + Windows Server 2019 reversible password encryption must be disabled. + <VulnDiscussion>Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords, which are easily compromised. For this reason, this policy must never be enabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000196 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Store passwords using reversible encryption" to "Disabled". + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for "Store passwords using reversible encryption" is not set to "Disabled", this is a finding. + + + + + + + SRG-OS-000075-GPOS-00043 + <GroupDescription></GroupDescription> + + WN19-AC-000060 + Windows Server 2019 minimum password age must be configured to at least one day. + <VulnDiscussion>Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database. This enables users to effectively negate the purpose of mandating periodic password changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000198 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Minimum password age" to at least "1" day. + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for the "Minimum password age" is set to "0" days ("Password can be changed immediately"), this is a finding. + + + + + + + SRG-OS-000076-GPOS-00044 + <GroupDescription></GroupDescription> + + WN19-AC-000050 + Windows Server 2019 maximum password age must be configured to 60 days or less. + <VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000199 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Maximum password age" to "60" days or less (excluding "0", which is unacceptable). + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for the "Maximum password age" is greater than "60" days, this is a finding. + +If the value is set to "0" (never expires), this is a finding. + + + + + + + SRG-OS-000077-GPOS-00045 + <GroupDescription></GroupDescription> + + WN19-AC-000040 + Windows Server 2019 password history must be configured to 24 passwords remembered. + <VulnDiscussion>A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change to a unique password on a regularly scheduled basis. This enables users to effectively negate the purpose of mandating periodic password changes. The default value is "24" for Windows domain systems. DoD has decided this is the appropriate value for all Windows systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000200 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Enforce password history" to "24" passwords remembered. + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for "Enforce password history" is less than "24" passwords remembered, this is a finding. + + + + + + + SRG-OS-000121-GPOS-00062 + <GroupDescription></GroupDescription> + + WN19-SO-000010 + Windows Server 2019 must have the built-in guest account disabled. + <VulnDiscussion>A system faces an increased vulnerability threat if the built-in guest account is not disabled. This is a known account that exists on all Windows systems and cannot be deleted. This account is initialized during the installation of the operating system with no password assigned.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + DPMS Target Windows 2019 + DISA + DPMS Target + Windows 2019 + 3483 + + CCI-000804 + Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Guest account status" to "Disabled". + + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. + +If the value for "Accounts: Guest account status" is not set to "Disabled", this is a finding. + + + + + + diff --git a/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.log b/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.log new file mode 100644 index 000000000..508afac8c --- /dev/null +++ b/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.log @@ -0,0 +1,15 @@ +V-92993::*::'' +V-93063::- Administrators::- Administrators`r`nSystems that have the Hyper-V role will also have "Virtual Machines" given this user right (this may be displayed as "NT Virtual Machine\Virtual Machines", SID S-1-5-83-0). This is not a finding. +V-93175::\SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\::\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ +V-93217::*::HardCodedRule(ServiceRule)@{DscResource = 'Service'; Ensure = 'Present'; ServiceName = $null; ServiceState = 'Running'; StartupType = $null; OrganizationValueTestString = 'ServiceName/StartupType is populated with correct AntiVirus service information'} +V-93257::0x00000000 (0) (Security), 0x00000001 (1) (Basic)::0 or 1 +V-93259::0x00000000 (0) - No peering (HTTP Only)::0, 1, 2, 99 or 100 +V-93261::0x00000000 (0) (or if the Value Name does not exist)::0 +V-93263::0x00000000 (0) (or if the Value Name does not exist)::0 +V-93267::0x00000000 (0) (or if the Value Name does not exist)::0 +V-93311::0x00000002 (2) (or if the Value Name does not exist)::2 +V-93413::0x00000000 (0) (or if the Value Name does not exist)::0 +V-93463::*::HardCodedRule(AccountPolicyRule)@{DscResource = 'AccountPolicy'; PolicyName = 'Minimum password length'; PolicyValue = $null; OrganizationValueTestString = "'{0}' -ge '14'"} +V-93523::0x00000002 (2) (Prompt for consent on the secure desktop)::1 or 2 +V-93563::0x00000000 (0) (or if the Value Name does not exist)::0 +V-93571::*::HardCodedRule(ServiceRule)@{DscResource = 'Service'; Ensure = 'Present'; ServiceName = $null; ServiceState = 'Running'; StartupType = $null; OrganizationValueTestString = 'ServiceName/StartupType is populated with correct Firewall service information'} diff --git a/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.xml b/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.xml new file mode 100644 index 000000000..258db95ac --- /dev/null +++ b/StigData/Archive/Windows.Server.2019/U_MS_Windows_Server_2019_MS_STIG_V1R2_Manual-xccdf.xml @@ -0,0 +1,13475 @@ + + + + accepted + Windows Server 2019 Security Technical Implementation Guide + This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil. + + + + DISA + STIG.DOD.MIL + + Release: 2 Benchmark Date: 26 Jul 2019 + 1 + + I - Mission Critical Classified + <ProfileDescription></ProfileDescription> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + I - Mission Critical Sensitive + <ProfileDescription></ProfileDescription> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + II - Mission Support Public + <ProfileDescription></ProfileDescription> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + III - Administrative Classified + <ProfileDescription></ProfileDescription> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + III - Administrative Sensitive + <ProfileDescription></ProfileDescription> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + I - Mission Critical Public<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>SRG-OS-000028-GPOS-00009<GroupDescription></GroupDescription>WN19-SO-000120Windows Server 2019 machine inactivity limit must be set to 15 minutes or less, locking the system with the screen saver.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and should be locked when unattended. The screen saver should be set at a maximum of 15 minutes and be password protected. This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer. + +Satisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000056CCI-000057CCI-000060Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive logon: Machine inactivity limit" to "900" seconds or less, excluding "0" which is effectively disabled.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: InactivityTimeoutSecs + +Value Type: REG_DWORD +Value: 0x00000384 (900) (or less, excluding "0" which is effectively disabled)SRG-OS-000297-GPOS-00115<GroupDescription></GroupDescription>WN19-DC-000410Windows Server 2019 Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on through Remote Desktop Services" user right defines the accounts that are prevented from logging on using Remote Desktop Services. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002314Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on through Remote Desktop Services" to include the following: + +- Guests GroupThis applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on through Remote Desktop Services" user right, this is a finding: + +- Guests Group + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If the following SID(s) are not defined for the "SeDenyRemoteInteractiveLogonRight" user right, this is a finding. + +S-1-5-32-546 (Guests)SRG-OS-000297-GPOS-00115<GroupDescription></GroupDescription>WN19-MS-000120Windows Server 2019 Deny log on through Remote Desktop Services user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and all local accounts and from unauthenticated access on all systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on through Remote Desktop Services" user right defines the accounts that are prevented from logging on using Remote Desktop Services. + +In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. + +Local accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002314Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on through Remote Desktop Services" to include the following: + +Domain Systems Only: +- Enterprise Admins group +- Domain Admins group +- Local account (see Note below) + +All Systems: +- Guests group + +Note: "Local account" is referring to the Windows built-in security group.This applies to member servers and standalone systems. A separate version applies to domain controllers. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on through Remote Desktop Services" user right, this is a finding: + +Domain Systems Only: +- Enterprise Admins group +- Domain Admins group +- Local account (see Note below) + +All Systems: +- Guests group + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If the following SIDs are not defined for the "SeDenyRemoteInteractiveLogonRight" user right, this is a finding. + +Domain Systems Only: +S-1-5-root domain-519 (Enterprise Admins) +S-1-5-domain-512 (Domain Admins) +S-1-5-113 ("Local account") + +All Systems: +S-1-5-32-546 (Guests) + +Note: "Local account" is referring to the Windows built-in security group.SRG-OS-000032-GPOS-00013<GroupDescription></GroupDescription>WN19-AU-000190Windows Server 2019 must be configured to audit logon successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed. + +Satisfies: SRG-OS-000032-GPOS-00013, SRG-OS-000470-GPOS-00214, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000475-GPOS-00220</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000067CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logon" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Logon - SuccessSRG-OS-000032-GPOS-00013<GroupDescription></GroupDescription>WN19-AU-000200Windows Server 2019 must be configured to audit logon failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed. + +Satisfies: SRG-OS-000032-GPOS-00013, SRG-OS-000470-GPOS-00214, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000475-GPOS-00220</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000067CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logon" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Logon - FailureSRG-OS-000033-GPOS-00014<GroupDescription></GroupDescription>WN19-CC-000370Windows Server 2019 Remote Desktop Services must require secure Remote Procedure Call (RPC) communications.<VulnDiscussion>Allowing unsecure RPC communication exposes the system to man-in-the-middle attacks and data disclosure attacks. A man-in-the-middle attack occurs when an intruder captures packets between a client and server and modifies them before allowing the packets to be exchanged. Usually the attacker will modify the information in the packets in an attempt to cause either the client or server to reveal sensitive information. + +Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000250-GPOS-00093</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000068CCI-001453Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> "Require secure RPC communication" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fEncryptRPCTraffic + +Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000033-GPOS-00014<GroupDescription></GroupDescription>WN19-CC-000380Windows Server 2019 Remote Desktop Services must be configured with the client connection encryption set to High Level.<VulnDiscussion>Remote connections must be encrypted to prevent interception of data or sensitive information. Selecting "High Level" will ensure encryption of Remote Desktop Services sessions in both directions. + +Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000250-GPOS-00093</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000068CCI-001453Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> "Set client connection encryption level" to "Enabled" with "High Level" selected.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: MinEncryptionLevel + +Type: REG_DWORD +Value: 0x00000003 (3)SRG-OS-000002-GPOS-00002<GroupDescription></GroupDescription>WN19-00-000300Windows Server 2019 must automatically remove or disable temporary user accounts after 72 hours.<VulnDiscussion>If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation. + +Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. + +If temporary accounts are used, the operating system must be configured to automatically terminate these types of accounts after a DoD-defined time period of 72 hours. + +To address access requirements, many operating systems may be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000016Configure temporary user accounts to automatically expire within 72 hours. + +Domain accounts can be configured with an account expiration date, under "Account" properties. + +Local accounts can be configured to expire with the command "Net user [username] /expires:[mm/dd/yyyy]", where username is the name of the temporary user account. + +Delete any temporary user accounts that are no longer necessary.Review temporary user accounts for expiration dates. + +Determine if temporary user accounts are used and identify any that exist. If none exist, this is NA. + +Domain Controllers: + +Open "PowerShell". + +Enter "Search-ADAccount -AccountExpiring | FT Name, AccountExpirationDate". + +If "AccountExpirationDate" has not been defined within 72 hours for any temporary user account, this is a finding. + +Member servers and standalone systems: + +Open "Command Prompt". + +Run "Net user [username]", where [username] is the name of the temporary user account. + +If "Account expires" has not been defined within 72 hours for any temporary user account, this is a finding.SRG-OS-000123-GPOS-00064<GroupDescription></GroupDescription>WN19-00-000310Windows Server 2019 must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours.<VulnDiscussion>Emergency administrator accounts are privileged accounts established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability. + +Emergency administrator accounts are different from infrequently used accounts (i.e., local logon accounts used by system administrators when network or normal logon/access is not available). Infrequently used accounts are not subject to automatic termination dates. Emergency accounts are accounts created in response to crisis situations, usually for use by maintenance personnel. The automatic expiration or disabling time period may be extended as needed until the crisis is resolved; however, it must not be extended indefinitely. A permanent account should be established for privileged users who need long-term maintenance accounts. + +To address access requirements, many operating systems can be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001682Remove emergency administrator accounts after a crisis has been resolved or configure the accounts to automatically expire within 72 hours. + +Domain accounts can be configured with an account expiration date, under "Account" properties. + +Local accounts can be configured to expire with the command "Net user [username] /expires:[mm/dd/yyyy]", where username is the name of the temporary user account.Determine if emergency administrator accounts are used and identify any that exist. If none exist, this is NA. + +If emergency administrator accounts cannot be configured with an expiration date due to an ongoing crisis, the accounts must be disabled or removed when the crisis is resolved. + +If emergency administrator accounts have not been configured with an expiration date or have not been disabled or removed following the resolution of a crisis, this is a finding. + +Domain Controllers: + +Open "PowerShell". + +Enter "Search-ADAccount -AccountExpiring | FT Name, AccountExpirationDate". + +If "AccountExpirationDate" has been defined and is not within 72 hours for an emergency administrator account, this is a finding. + +Member servers and standalone systems: + +Open "Command Prompt". + +Run "Net user [username]", where [username] is the name of the emergency account. + +If "Account expires" has been defined and is not within 72 hours for an emergency administrator account, this is a finding.SRG-OS-000004-GPOS-00004<GroupDescription></GroupDescription>WN19-AU-000100Windows Server 2019 must be configured to audit Account Management - Security Group Management successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Security Group Management records events such as creating, deleting, or changing security groups, including changes in group members. + +Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Security Group Management" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Management >> Security Group Management - SuccessSRG-OS-000004-GPOS-00004<GroupDescription></GroupDescription>WN19-AU-000110Windows Server 2019 must be configured to audit Account Management - User Account Management successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts. + +Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit User Account Management" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Management >> User Account Management - SuccessSRG-OS-000004-GPOS-00004<GroupDescription></GroupDescription>WN19-AU-000120Windows Server 2019 must be configured to audit Account Management - User Account Management failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts. + +Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit User Account Management" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Management >> User Account Management - FailureSRG-OS-000004-GPOS-00004<GroupDescription></GroupDescription>WN19-DC-000230Windows Server 2019 must be configured to audit Account Management - Computer Account Management successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Computer Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling computer accounts. + +Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Computer Account Management" with "Success" selected.This applies to domain controllers. It is NA for other systems. + +Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Management >> Computer Account Management - SuccessSRG-OS-000240-GPOS-00090<GroupDescription></GroupDescription>WN19-AU-000150Windows Server 2019 must be configured to audit Logon/Logoff - Account Lockout successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Account Lockout events can be used to identify potentially malicious logon attempts. + +Satisfies: SRG-OS-000240-GPOS-00090, SRG-OS-000470-GPOS-00214</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-001404Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Account Lockout - SuccessSRG-OS-000240-GPOS-00090<GroupDescription></GroupDescription>WN19-AU-000160Windows Server 2019 must be configured to audit Logon/Logoff - Account Lockout failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Account Lockout events can be used to identify potentially malicious logon attempts. + +Satisfies: SRG-OS-000240-GPOS-00090, SRG-OS-000470-GPOS-00214</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-001404Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Account Lockout - FailureSRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN19-00-000130Windows Server 2019 local volumes must use a format that supports NTFS attributes.<VulnDiscussion>The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system. To support this, volumes must be formatted using a file system that supports NTFS attributes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000213Format volumes to use NTFS or ReFS.Open "Computer Management". + +Select "Disk Management" under "Storage". + +For each local volume, if the file system does not indicate "NTFS", this is a finding. + +"ReFS" (resilient file system) is also acceptable and would not be a finding. + +This does not apply to system partitions such the Recovery and EFI System Partition.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN19-00-000180Windows Server 2019 non-administrative accounts or groups must only have print permissions on printer shares.<VulnDiscussion>Windows shares are a means by which files, folders, printers, and other resources can be published for network users to access. Improper configuration can permit access to devices and data beyond a user's need.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000213Configure the permissions on shared printers to restrict standard users to only have Print permissions.Open "Printers & scanners" in "Settings". + +If there are no printers configured, this is NA. (Exclude Microsoft Print to PDF and Microsoft XPS Document Writer, which do not support sharing.) + +For each printer: + +Select the printer and "Manage". + +Select "Printer Properties". + +Select the "Sharing" tab. + +If "Share this printer" is checked, select the "Security" tab. + +If any standard user accounts or groups have permissions other than "Print", this is a finding. + +The default is for the "Everyone" group to be given "Print" permission. + +"All APPLICATION PACKAGES" and "CREATOR OWNER" are not standard user accounts.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN19-DC-000340Windows Server 2019 Access this computer from the network user right must only be assigned to the Administrators, Authenticated Users, and +Enterprise Domain Controllers groups on domain controllers.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Access this computer from the network" right may access resources on the system, and this right must be limited to those requiring it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Access this computer from the network" to include only the following accounts or groups: + +- Administrators +- Authenticated Users +- Enterprise Domain ControllersThis applies to domain controllers. It is NA for other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Access this computer from the network" right, this is a finding. + +- Administrators +- Authenticated Users +- Enterprise Domain Controllers + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeNetworkLogonRight" user right, this is a finding. + +S-1-5-32-544 (Administrators) +S-1-5-11 (Authenticated Users) +S-1-5-9 (Enterprise Domain Controllers) + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN19-00-000050) and required frequency of changes (WN19-00-000060).SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN19-DC-000360Windows Server 2019 Allow log on through Remote Desktop Services user right must only be assigned to the Administrators group on domain controllers.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Allow log on through Remote Desktop Services" user right can access a system through Remote Desktop.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Allow log on through Remote Desktop Services" to include only the following accounts or groups: + +- AdministratorsThis applies to domain controllers, it is NA for other systems. + +Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Allow log on through Remote Desktop Services" user right, this is a finding. + +- Administrators + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeRemoteInteractiveLogonRight" user right, this is a finding. + +S-1-5-32-544 (Administrators)SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN19-DC-000370Windows Server 2019 Deny access to this computer from the network user right on domain controllers must be configured to prevent unauthenticated access.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny access to this computer from the network" user right defines the accounts that are prevented from logging on from the network. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny access to this computer from the network" to include the following: + +- Guests GroupThis applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny access to this computer from the network" user right, this is a finding: + +- Guests Group + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If the following SIDs are not defined for the "SeDenyNetworkLogonRight" user right, this is a finding. + +S-1-5-32-546 (Guests)SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN19-DC-000380Windows Server 2019 Deny log on as a batch job user right on domain controllers must be configured to prevent unauthenticated access.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on as a batch job" user right defines accounts that are prevented from logging on to the system as a batch job, such as Task Scheduler. + +The Guests group must be assigned to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on as a batch job" to include the following: + +- Guests GroupThis applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on as a batch job" user right, this is a finding: + +- Guests Group + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If the following SID(s) are not defined for the "SeDenyBatchLogonRight" user right, this is a finding: + +S-1-5-32-546 (Guests)SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN19-DC-000390Windows Server 2019 Deny log on as a service user right must be configured to include no accounts or groups (blank) on domain controllers.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on as a service" user right defines accounts that are denied logon as a service. + +Incorrect configurations could prevent services from starting and result in a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on as a service" to include no entries (blank).This applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are defined for the "Deny log on as a service" user right, this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs are granted the "SeDenyServiceLogonRight" user right, this is a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN19-DC-000400Windows Server 2019 Deny log on locally user right on domain controllers must be configured to prevent unauthenticated access.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on locally" user right defines accounts that are prevented from logging on interactively. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on locally" to include the following: + +- Guests GroupThis applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on locally" user right, this is a finding: + +- Guests Group + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If the following SID(s) are not defined for the "SeDenyInteractiveLogonRight" user right, this is a finding: + +S-1-5-32-546 (Guests)SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN19-MS-000070Windows Server 2019 Access this computer from the network user right must only be assigned to the Administrators and Authenticated Users groups on domain-joined member servers and standalone systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Access this computer from the network" user right may access resources on the system, and this right must be limited to those requiring it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Access this computer from the network" to include only the following accounts or groups: + +- Administrators +- Authenticated UsersThis applies to member servers and standalone systems. A separate version applies to domain controllers. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Access this computer from the network" user right, this is a finding: + +- Administrators +- Authenticated Users + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeNetworkLogonRight" user right, this is a finding: + +S-1-5-32-544 (Administrators) +S-1-5-11 (Authenticated Users) + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN19-00-000050) and required frequency of changes (WN19-00-000060).SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN19-MS-000080Windows Server 2019 Deny access to this computer from the network user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and local accounts and from unauthenticated access on all systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny access to this computer from the network" user right defines the accounts that are prevented from logging on from the network. + +In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. + +Local accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny access to this computer from the network" to include the following: + +Domain Systems Only: +- Enterprise Admins group +- Domain Admins group +- "Local account and member of Administrators group" or "Local account" (see Note below) + +All Systems: +- Guests group + +Note: These are built-in security groups. "Local account" is more restrictive but may cause issues on servers such as systems that provide failover clustering.This applies to member servers and standalone systems. A separate version applies to domain controllers. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny access to this computer from the network" user right, this is a finding: + +Domain Systems Only: +- Enterprise Admins group +- Domain Admins group +- "Local account and member of Administrators group" or "Local account" (see Note below) + +All Systems: +- Guests group + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If the following SIDs are not defined for the "SeDenyNetworkLogonRight" user right, this is a finding. + +Domain Systems Only: +S-1-5-root domain-519 (Enterprise Admins) +S-1-5-domain-512 (Domain Admins) +S-1-5-114 ("Local account and member of Administrators group") or S-1-5-113 ("Local account") + +All Systems: +S-1-5-32-546 (Guests) + +Note: These are built-in security groups. "Local account" is more restrictive but may cause issues on servers such as systems that provide failover clustering.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN19-MS-000090Windows Server 2019 Deny log on as a batch job user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and from unauthenticated access on all systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on as a batch job" user right defines accounts that are prevented from logging on to the system as a batch job, such as Task Scheduler. + +In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. + +The Guests group must be assigned to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on as a batch job" to include the following: + +Domain Systems Only: +- Enterprise Admins Group +- Domain Admins Group + +All Systems: +- Guests GroupThis applies to member servers and standalone systems. A separate version applies to domain controllers. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on as a batch job" user right, this is a finding: + +Domain Systems Only: +- Enterprise Admins Group +- Domain Admins Group + +All Systems: +- Guests Group + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If the following SIDs are not defined for the "SeDenyBatchLogonRight" user right, this is a finding. + +Domain Systems Only: +S-1-5-root domain-519 (Enterprise Admins) +S-1-5-domain-512 (Domain Admins) + +All Systems: +S-1-5-32-546 (Guests)SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN19-MS-000100Windows Server 2019 Deny log on as a service user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts. No other groups or accounts must be assigned this right.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on as a service" user right defines accounts that are denied logon as a service. + +In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. + +Incorrect configurations could prevent services from starting and result in a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on as a service" to include the following: + +Domain systems: +- Enterprise Admins Group +- Domain Admins GroupThis applies to member servers and standalone systems. A separate version applies to domain controllers. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on as a service" user right on domain-joined systems, this is a finding: + +- Enterprise Admins Group +- Domain Admins Group + +If any accounts or groups are defined for the "Deny log on as a service" user right on non-domain-joined systems, this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If the following SIDs are not defined for the "SeDenyServiceLogonRight" user right on domain-joined systems, this is a finding: + +S-1-5-root domain-519 (Enterprise Admins) +S-1-5-domain-512 (Domain Admins) + +If any SIDs are defined for the user right on non-domain-joined systems, this is a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN19-MS-000110Windows Server 2019 Deny log on locally user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts and from unauthenticated access on all systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on locally" user right defines accounts that are prevented from logging on interactively. + +In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Deny log on locally" to include the following: + +Domain Systems Only: +- Enterprise Admins Group +- Domain Admins Group + +All Systems: +- Guests GroupThis applies to member servers and standalone systems. A separate version applies to domain controllers. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on locally" user right, this is a finding: + +Domain Systems Only: +- Enterprise Admins Group +- Domain Admins Group + +All Systems: +- Guests Group + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If the following SIDs are not defined for the "SeDenyInteractiveLogonRight" user right, this is a finding: + +Domain Systems Only: +S-1-5-root domain-519 (Enterprise Admins) +S-1-5-domain-512 (Domain Admins) + +All Systems: +S-1-5-32-546 (Guests)SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>WN19-UR-000030Windows Server 2019 Allow log on locally user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Allow log on locally" user right can log on interactively to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000213Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Allow log on locally" to include only the following accounts or groups: + +- AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Allow log on locally" user right, this is a finding: + +- Administrators + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeInteractiveLogonRight" user right, this is a finding: + +S-1-5-32-544 (Administrators) + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN19-00-000050) and required frequency of changes (WN19-00-000060).SRG-OS-000312-GPOS-00122<GroupDescription></GroupDescription>WN19-00-000140Windows Server 2019 permissions for the system drive root directory (usually C:\) must conform to minimum requirements.<VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + +The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002165Maintain the default permissions for the system drive's root directory and configure the Security Option "Network access: Let Everyone permissions apply to anonymous users" to "Disabled" (WN19-SO-000240). + +Default Permissions +C:\ +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +SYSTEM - Full control - This folder, subfolders, and files +Administrators - Full control - This folder, subfolders, and files +Users - Read & execute - This folder, subfolders, and files +Users - Create folders/append data - This folder and subfolders +Users - Create files/write data - Subfolders only +CREATOR OWNER - Full Control - Subfolders and files onlyThe default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Review the permissions for the system drive's root directory (usually C:\). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions except where noted as defaults. Individual accounts must not be used to assign permissions. + +If permissions are not as restrictive as the default permissions listed below, this is a finding. + +Viewing in File Explorer: + +View the Properties of the system drive's root directory. + +Select the "Security" tab, and the "Advanced" button. + +Default permissions: +C:\ +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +SYSTEM - Full control - This folder, subfolders, and files +Administrators - Full control - This folder, subfolders, and files +Users - Read & execute - This folder, subfolders, and files +Users - Create folders/append data - This folder and subfolders +Users - Create files/write data - Subfolders only +CREATOR OWNER - Full Control - Subfolders and files only + +Alternately, use icacls: + +Open "Command Prompt (Admin)". + +Enter "icacls" followed by the directory: + +"icacls c:\" + +The following results should be displayed: + +c:\ +NT AUTHORITY\SYSTEM:(OI)(CI)(F) +BUILTIN\Administrators:(OI)(CI)(F) +BUILTIN\Users:(OI)(CI)(RX) +BUILTIN\Users:(CI)(AD) +BUILTIN\Users:(CI)(IO)(WD) +CREATOR OWNER:(OI)(CI)(IO)(F) +Successfully processed 1 files; Failed processing 0 filesSRG-OS-000312-GPOS-00122<GroupDescription></GroupDescription>WN19-00-000150Windows Server 2019 permissions for program file directories must conform to minimum requirements.<VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + +The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002165Maintain the default permissions for the program file directories and configure the Security Option "Network access: Let Everyone permissions apply to anonymous users" to "Disabled" (WN19-SO-000240). + +Default permissions: +\Program Files and \Program Files (x86) +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders, and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and filesThe default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Review the permissions for the program file directories (Program Files and Program Files [x86]). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. Individual accounts must not be used to assign permissions. + +If permissions are not as restrictive as the default permissions listed below, this is a finding. + +Viewing in File Explorer: + +For each folder, view the Properties. + +Select the "Security" tab, and the "Advanced" button. + +Default permissions: +\Program Files and \Program Files (x86) +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files + +Alternately, use icacls: + +Open a Command prompt (admin). + +Enter "icacls" followed by the directory: + +'icacls "c:\program files"' +'icacls "c:\program files (x86)"' + +The following results should be displayed for each when entered: + +c:\program files (c:\program files (x86)) +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 filesSRG-OS-000312-GPOS-00122<GroupDescription></GroupDescription>WN19-00-000160Windows Server 2019 permissions for the Windows installation directory must conform to minimum requirements.<VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + +The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002165Maintain the default file ACLs and configure the Security Option "Network access: Let Everyone permissions apply to anonymous users" to "Disabled" (WN19-SO-000240). + +Default permissions: +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders, and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and filesThe default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Review the permissions for the Windows installation directory (usually C:\Windows). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. Individual accounts must not be used to assign permissions. + +If permissions are not as restrictive as the default permissions listed below, this is a finding: + +Viewing in File Explorer: + +For each folder, view the Properties. + +Select the "Security" tab and the "Advanced" button. + +Default permissions: +\Windows +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders, and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files + +Alternately, use icacls: + +Open a Command prompt (admin). + +Enter "icacls" followed by the directory: + +"icacls c:\windows" + +The following results should be displayed for each when entered: + +c:\windows +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 filesSRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-00-000170Windows Server 2019 default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.<VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Maintain the default permissions for the HKEY_LOCAL_MACHINE registry hive. + +The default permissions of the higher-level keys are noted below. + +HKEY_LOCAL_MACHINE\SECURITY + +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +SYSTEM - Full Control - This key and subkeys +Administrators - Special - This key and subkeys + +HKEY_LOCAL_MACHINE\SOFTWARE + +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +Users - Read - This key and subkeys +Administrators - Full Control - This key and subkeys +SYSTEM - Full Control - This key and subkeys +CREATOR OWNER - Full Control - This key and subkeys +ALL APPLICATION PACKAGES - Read - This key and subkeys + +HKEY_LOCAL_MACHINE\SYSTEM + +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +Users - Read - This key and subkeys +Administrators - Full Control - This key and subkeys +SYSTEM - Full Control - This key and subkeys +CREATOR OWNER - Full Control - Subkeys only +ALL APPLICATION PACKAGES - Read - This key and subkeys + +Microsoft has also given Read permission to the SOFTWARE and SYSTEM registry keys in Windows Server 2019 to the following SID. +S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. + +If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. + +If permissions are not as restrictive as the default permissions listed below, this is a finding: + +Run "Regedit". + +Right-click on the registry areas noted below. + +Select "Permissions" and the "Advanced" button. + +HKEY_LOCAL_MACHINE\SECURITY + +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +SYSTEM - Full Control - This key and subkeys +Administrators - Special - This key and subkeys + +HKEY_LOCAL_MACHINE\SOFTWARE + +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +Users - Read - This key and subkeys +Administrators - Full Control - This key and subkeys +SYSTEM - Full Control - This key and subkeys +CREATOR OWNER - Full Control - This key and subkeys +ALL APPLICATION PACKAGES - Read - This key and subkeys + +HKEY_LOCAL_MACHINE\SYSTEM + +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +Users - Read - This key and subkeys +Administrators - Full Control - This key and subkeys +SYSTEM - Full Control - This key and subkeys +CREATOR OWNER - Full Control - Subkeys only +ALL APPLICATION PACKAGES - Read - This key and subkeys + +Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. + +Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in Windows Server 2019 to the following SID, this is currently not a finding. +S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681 + +If the defaults have not been changed, these are not a finding.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-DC-000010Windows Server 2019 must only allow administrators responsible for the domain controller to have Administrator rights on the system.<VulnDiscussion>An account that does not have Administrator duties must not have Administrator rights. Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack. + +System administrators must log on to systems using only accounts with the minimum level of authority necessary. + +Standard user accounts must not be members of the built-in Administrators group.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the Administrators group to include only administrator groups or accounts that are responsible for the system. + +Remove any standard user accounts.This applies to domain controllers. A separate version applies to other systems. + +Review the Administrators group. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group. + +Standard user accounts must not be members of the local administrator group. + +If prohibited accounts are members of the local administrators group, this is a finding. + +If the built-in Administrator account or other required administrative accounts are found on the system, this is not a finding.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-DC-000070Windows Server 2019 permissions on the Active Directory data files must only allow System and Administrators access.<VulnDiscussion>Improper access permissions for directory data-related files could allow unauthorized users to read, modify, or delete directory data or audit trails.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Maintain the permissions on NTDS database and log files as follows: + +NT AUTHORITY\SYSTEM:(I)(F) +BUILTIN\Administrators:(I)(F) + +(I) - permission inherited from parent container +(F) - full accessThis applies to domain controllers. It is NA for other systems. + +Run "Regedit". + +Navigate to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters". + +Note the directory locations in the values for: + +Database log files path +DSA Database file + +By default, they will be \Windows\NTDS. + +If the locations are different, the following will need to be run for each. + +Open "Command Prompt (Admin)". + +Navigate to the NTDS directory (\Windows\NTDS by default). + +Run "icacls *.*". + +If the permissions on each file are not as restrictive as the following, this is a finding: + +NT AUTHORITY\SYSTEM:(I)(F) +BUILTIN\Administrators:(I)(F) + +(I) - permission inherited from parent container +(F) - full accessSRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-DC-000080Windows Server 2019 Active Directory SYSVOL directory must have the proper access control permissions.<VulnDiscussion>Improper access permissions for directory data files could allow unauthorized users to read, modify, or delete directory data. + +The SYSVOL directory contains public files (to the domain) such as policies and logon scripts. Data in shared subdirectories are replicated to all domain controllers in a domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Maintain the permissions on the SYSVOL directory. Do not allow greater than "Read & execute" permissions for standard user accounts or groups. The defaults below meet this requirement: + +C:\Windows\SYSVOL +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +Authenticated Users - Read & execute - This folder, subfolder, and files +Server Operators - Read & execute- This folder, subfolder, and files +Administrators - Special - This folder only (Special = Basic Permissions: all selected except Full control) +CREATOR OWNER - Full control - Subfolders and files only +Administrators - Full control - Subfolders and files only +SYSTEM - Full control - This folder, subfolders, and filesThis applies to domain controllers. It is NA for other systems. + +Open a command prompt. + +Run "net share". + +Make note of the directory location of the SYSVOL share. + +By default, this will be \Windows\SYSVOL\sysvol. For this requirement, permissions will be verified at the first SYSVOL directory level. + +If any standard user accounts or groups have greater than "Read & execute" permissions, this is a finding. + +The default permissions noted below meet this requirement: + +Open "Command Prompt". + +Run "icacls c:\Windows\SYSVOL". + +The following results should be displayed: + +NT AUTHORITY\Authenticated Users:(RX) +NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(GR,GE) +BUILTIN\Server Operators:(RX) +BUILTIN\Server Operators:(OI)(CI)(IO)(GR,GE) +BUILTIN\Administrators:(M,WDAC,WO) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(F) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +CREATOR OWNER:(OI)(CI)(IO)(F) + +(RX) - Read & execute + +Run "icacls /help" to view definitions of other permission codes. + +Alternately, open "File Explorer". + +Navigate to \Windows\SYSVOL (or the directory noted previously if different). + +Right-click the directory and select properties. + +Select the "Security" tab and click "Advanced". + +Default permissions: + +C:\Windows\SYSVOL +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +Authenticated Users - Read & execute - This folder, subfolder, and files +Server Operators - Read & execute- This folder, subfolder, and files +Administrators - Special - This folder only (Special = Basic Permissions: all selected except Full control) +CREATOR OWNER - Full control - Subfolders and files only +Administrators - Full control - Subfolders and files only +SYSTEM - Full control - This folder, subfolders, and filesSRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-DC-000090Windows Server 2019 Active Directory Group Policy objects must have proper access control permissions.<VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems relying on the directory service. + +For Active Directory (AD), the Group Policy objects require special attention. In a distributed administration model (i.e., help desk), Group Policy objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for Group Policy objects, this could allow an intruder to change the security policy applied to all domain client computers (workstations and servers).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Maintain the permissions on Group Policy objects to not allow greater than "Read" and "Apply group policy" for standard user accounts or groups. The default permissions below meet this requirement: + +Authenticated Users - Read, Apply group policy, Special permissions + +The special permissions for Authenticated Users are for Read-type Properties. + +CREATOR OWNER - Special permissions +SYSTEM - Read, Write, Create all child objects, Delete all child objects, Special permissions +Domain Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions +Enterprise Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + +Document any other access permissions that allow the objects to be updated with the ISSO. + +The Domain Admins and Enterprise Admins will not have the "Delete all child objects" permission on the two default Group Policy objects: Default Domain Policy and Default Domain Controllers Policy. They will have this permission on created Group Policy objects.This applies to domain controllers. It is NA for other systems. + +Review the permissions on Group Policy objects. + +Open "Group Policy Management" (available from various menus or run "gpmc.msc"). + +Navigate to "Group Policy Objects" in the domain being reviewed (Forest >> Domains >> Domain). + +For each Group Policy object: + +Select the Group Policy object item in the left pane. + +Select the "Delegation" tab in the right pane. + +Select the "Advanced" button. + +Select each Group or user name. + +View the permissions. + +If any standard user accounts or groups have "Allow" permissions greater than "Read" and "Apply group policy", this is a finding. + +Other access permissions that allow the objects to be updated are considered findings unless specifically documented by the ISSO. + +The default permissions noted below satisfy this requirement. + +The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the next "Advanced" button, the desired Permission entry, and the "Edit" button. + +Authenticated Users - Read, Apply group policy, Special permissions + +The special permissions for Authenticated Users are for Read-type Properties. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +The special permissions for the following default groups are not the focus of this requirement and may include a wide range of permissions and properties: + +CREATOR OWNER - Special permissions +SYSTEM - Read, Write, Create all child objects, Delete all child objects, Special permissions +Domain Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions +Enterprise Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + +The Domain Admins and Enterprise Admins will not have the "Delete all child objects" permission on the two default Group Policy objects: Default Domain Policy and Default Domain Controllers Policy. They will have this permission on organization created Group Policy objects.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-DC-000100Windows Server 2019 Active Directory Domain Controllers Organizational Unit (OU) object must have the proper access control permissions.<VulnDiscussion>When Active Directory objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. + +The Domain Controllers OU object requires special attention as the Domain Controllers are central to the configuration and management of the domain. Inappropriate access permissions defined for the Domain Controllers OU could allow an intruder or unauthorized personnel to make changes that could lead to the compromise of the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Limit the permissions on the Domain Controllers OU to restrict changes to System, Domain Admins, Enterprise Admins and Administrators. + +The default permissions listed below satisfy this requirement. + +Domains supporting Microsoft Exchange will have additional Exchange related permissions on the Domain Controllers OU. These may include some change related permissions. + +CREATOR OWNER - Special permissions + +SELF - Special permissions + +Authenticated Users - Read, Special permissions + +The special permissions for Authenticated Users are Read types. + +SYSTEM - Full Control + +Domain Admins - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Enterprise Admins - Full Control + +Key Admins - Special permissions + +Enterprise Key Admins - Special permissions + +Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Pre-Windows 2000 Compatible Access - Special permissions + +The special permissions for Pre-Windows 2000 Compatible Access are Read types. + +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissionsThis applies to domain controllers. It is NA for other systems. + +Review the permissions on the Domain Controllers OU. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Select "Advanced Features" in the "View" menu if not previously selected. + +Select the "Domain Controllers" OU (folder in folder icon). + +Right-click and select "Properties". + +Select the "Security" tab. + +If the permissions on the Domain Controllers OU do not restrict changes to System, Domain Admins, Enterprise Admins and Administrators, this is a finding. + +The default permissions listed below satisfy this requirement. + +Domains supporting Microsoft Exchange will have additional Exchange related permissions on the Domain Controllers OU. These may include some change related permissions and are not a finding. + +The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "View" or "Edit" button. + +Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. + +CREATOR OWNER - Special permissions + +SELF - Special permissions + +Authenticated Users - Read, Special permissions + +The special permissions for Authenticated Users are Read types. + +If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +SYSTEM - Full Control + +Domain Admins - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Enterprise Admins - Full Control + +Key Admins - Special permissions + +Enterprise Key Admins - Special permissions + +Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Pre-Windows 2000 Compatible Access - Special permissions + +The Special permissions for Pre-Windows 2000 Compatible Access are Read types. + +If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissionsSRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-DC-000110Windows Server 2019 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions.<VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. + +For Active Directory, the OU objects require special attention. In a distributed administration model (i.e., help desk), OU objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for OU objects, it could allow an intruder to add or delete users in the OU. This could result in unauthorized access to data or a denial of service (DoS) to authorized users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Maintain the Allow type permissions on domain-defined OUs to be at least as restrictive as the defaults below. + +Document any additional permissions above Read with the ISSO if an approved distributed administration model (help desk or other user support staff) is implemented. + +CREATOR OWNER - Special permissions + +Self - Special permissions + +Authenticated Users - Read, Special permissions + +The special permissions for Authenticated Users are Read type. + +SYSTEM - Full Control + +Domain Admins - Full Control + +Enterprise Admins - Full Control + +Key Admins - Special permissions + +Enterprise Key Admins - Special permissions + +Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Pre-Windows 2000 Compatible Access - Special permissions + +The special permissions for Pre-Windows 2000 Compatible Access are for Read types. + +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissionsThis applies to domain controllers. It is NA for other systems. + +Review the permissions on domain-defined OUs. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +For each OU that is defined (folder in folder icon) excluding the Domain Controllers OU: + +Right-click the OU and select "Properties". + +Select the "Security" tab. + +If the Allow type permissions on the OU are not at least as restrictive as those below, this is a finding. + +The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "Edit" or "View" button. + +Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. + +CREATOR OWNER - Special permissions + +Self - Special permissions + +Authenticated Users - Read, Special permissions + +The Special permissions for Authenticated Users are Read type. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +SYSTEM - Full Control + +Domain Admins - Full Control + +Enterprise Admins - Full Control + +Key Admins - Special permissions + +Enterprise Key Admins - Special permissions + +Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Pre-Windows 2000 Compatible Access - Special permissions + +The Special permissions for Pre-Windows 2000 Compatible Access are for Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + +If an ISSO-approved distributed administration model (help desk or other user support staff) is implemented, permissions above Read may be allowed for groups documented by the ISSO. + +If any OU with improper permissions includes identification or authentication data (e.g., accounts, passwords, or password hash data) used by systems to determine access control, the severity is CAT I (e.g., OUs that include user accounts, including service/application accounts). + +If an OU with improper permissions does not include identification and authentication data used by systems to determine access control, the severity is CAT II (e.g., Workstation, Printer OUs).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-DC-000350Windows Server 2019 Add workstations to domain user right must only be assigned to the Administrators group on domain controllers.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Add workstations to domain" right may add computers to a domain. This could result in unapproved or incorrectly configured systems being added to a domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Add workstations to domain" to include only the following accounts or groups: + +- AdministratorsThis applies to domain controllers. It is NA for other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Add workstations to domain" right, this is a finding. + +- Administrators + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeMachineAccountPrivilege" user right, this is a finding. + +S-1-5-32-544 (Administrators)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-DC-000420Windows Server 2019 Enable computer and user accounts to be trusted for delegation user right must only be assigned to the Administrators group on domain controllers.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Enable computer and user accounts to be trusted for delegation" user right allows the "Trusted for Delegation" setting to be changed. This could allow unauthorized users to impersonate other users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Enable computer and user accounts to be trusted for delegation" to include only the following accounts or groups: + +- AdministratorsThis applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Enable computer and user accounts to be trusted for delegation" user right, this is a finding. + +- Administrators + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeEnableDelegationPrivilege" user right, this is a finding. + +S-1-5-32-544 (Administrators)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-MS-000010Windows Server 2019 must only allow administrators responsible for the member server or standalone system to have Administrator rights on the system.<VulnDiscussion>An account that does not have Administrator duties must not have Administrator rights. Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack. + +System administrators must log on to systems using only accounts with the minimum level of authority necessary. + +For domain-joined member servers, the Domain Admins group must be replaced by a domain member server administrator group (see V-36433 in the Active Directory Domain STIG). Restricting highly privileged accounts from the local Administrators group helps mitigate the risk of privilege escalation resulting from credential theft attacks. + +Standard user accounts must not be members of the built-in Administrators group.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the local "Administrators" group to include only administrator groups or accounts responsible for administration of the system. + +For domain-joined member servers, replace the Domain Admins group with a domain member server administrator group. + +Remove any standard user accounts.This applies to member servers and standalone systems. A separate version applies to domain controllers. + +Open "Computer Management". + +Navigate to "Groups" under "Local Users and Groups". + +Review the local "Administrators" group. + +Only administrator groups or accounts responsible for administration of the system may be members of the group. + +For domain-joined member servers, the Domain Admins group must be replaced by a domain member server administrator group. + +Standard user accounts must not be members of the local Administrator group. + +If accounts that do not have responsibility for administration of the system are members of the local Administrators group, this is a finding. + +If the built-in Administrator account or other required administrative accounts are found on the system, this is not a finding.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-MS-000060Windows Server 2019 must restrict remote calls to the Security Account Manager (SAM) to Administrators on domain-joined member servers and standalone systems.<VulnDiscussion>The Windows SAM stores users' passwords. Restricting Remote Procedure Call (RPC) connections to the SAM to Administrators helps protect those credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Navigate to the policy Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Restrict clients allowed to make remote calls to SAM". +Select "Edit Security" to configure the "Security descriptor:". + +Add "Administrators" in "Group or user names:" if it is not already listed (this is the default). + +Select "Administrators" in "Group or user names:". + +Select "Allow" for "Remote Access" in "Permissions for "Administrators". + +Click "OK". + +The "Security descriptor:" must be populated with "O:BAG:BAD:(A;;RC;;;BA) for the policy to be enforced.This applies to member servers and standalone systems; it is NA for domain controllers. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: RestrictRemoteSAM + +Value Type: REG_SZ +Value: O:BAG:BAD:(A;;RC;;;BA)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-MS-000130Windows Server 2019 Enable computer and user accounts to be trusted for delegation user right must not be assigned to any groups or accounts on domain-joined member servers and standalone systems.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Enable computer and user accounts to be trusted for delegation" user right allows the "Trusted for Delegation" setting to be changed. This could allow unauthorized users to impersonate other users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Enable computer and user accounts to be trusted for delegation" to be defined but containing no entries (blank).This applies to member servers and standalone systems. A separate version applies to domain controllers. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Enable computer and user accounts to be trusted for delegation" user right, this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs are granted the "SeEnableDelegationPrivilege" user right, this is a finding.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000010Windows Server 2019 Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Access Credential Manager as a trusted caller" user right may be able to retrieve the credentials of other accounts from Credential Manager.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Access Credential Manager as a trusted caller" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Access Credential Manager as a trusted caller" user right, this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs are granted the "SeTrustedCredManAccessPrivilege" user right, this is a finding.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000020Windows Server 2019 Act as part of the operating system user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Act as part of the operating system" user right can assume the identity of any user and gain access to resources that the user is authorized to access. Any accounts with this right can take complete control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Act as part of the operating system" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups (to include administrators), are granted the "Act as part of the operating system" user right, this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs are granted the "SeTcbPrivilege" user right, this is a finding. + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN19-00-000050) and required frequency of changes (WN19-00-000060). + +Passwords for accounts with this user right must be protected as highly privileged accounts.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000040Windows Server 2019 Back up files and directories user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Back up files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Back up files and directories" to include only the following accounts or groups: + +- AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Back up files and directories" user right, this is a finding: + +- Administrators + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeBackupPrivilege" user right, this is a finding: + +S-1-5-32-544 (Administrators) + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN19-00-000050) and required frequency of changes (WN19-00-000060).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000050Windows Server 2019 Create a pagefile user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create a pagefile" user right can change the size of a pagefile, which could affect system performance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a pagefile" to include only the following accounts or groups: + +- AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Create a pagefile" user right, this is a finding: + +- Administrators + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeCreatePagefilePrivilege" user right, this is a finding: + +S-1-5-32-544 (Administrators)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000060Windows Server 2019 Create a token object user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Create a token object" user right allows a process to create an access token. This could be used to provide elevated rights and compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create a token object" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Create a token object" user right, this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs are granted the "SeCreateTokenPrivilege" user right, this is a finding. + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN19-00-000050) and required frequency of changes (WN19-00-000060). + +Passwords for application accounts with this user right must be protected as highly privileged accounts.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000070Windows Server 2019 Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create global objects" user right can create objects that are available to all sessions, which could affect processes in other users' sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create global objects" to include only the following accounts or groups: + +- Administrators +- Service +- Local Service +- Network ServiceVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Create global objects" user right, this is a finding: + +- Administrators +- Service +- Local Service +- Network Service + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeCreateGlobalPrivilege" user right, this is a finding: + +S-1-5-32-544 (Administrators) +S-1-5-6 (Service) +S-1-5-19 (Local Service) +S-1-5-20 (Network Service) + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN19-00-000050) and required frequency of changes (WN19-00-000060).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000080Windows Server 2019 Create permanent shared objects user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create permanent shared objects" user right could expose sensitive data by creating shared objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create permanent shared objects" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Create permanent shared objects" user right, this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs are granted the "SeCreatePermanentPrivilege" user right, this is a finding.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000090Windows Server 2019 Create symbolic links user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create symbolic links" user right can create pointers to other objects, which could expose the system to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Create symbolic links" to include only the following accounts or groups: + +- Administrators + +Systems that have the Hyper-V role will also have "Virtual Machines" given this user right. If this needs to be added manually, enter it as "NT Virtual Machine\Virtual Machines".Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Create symbolic links" user right, this is a finding: + +- Administrators + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeCreateSymbolicLinkPrivilege" user right, this is a finding: + +S-1-5-32-544 (Administrators) + +Systems that have the Hyper-V role will also have "Virtual Machines" given this user right (this may be displayed as "NT Virtual Machine\Virtual Machines", SID S-1-5-83-0). This is not a finding.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000100Windows Server 2019 Debug programs: user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Debug programs" user right can attach a debugger to any process or to the kernel, providing complete access to sensitive and critical operating system components. This right is given to Administrators in the default configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Debug programs" to include only the following accounts or groups: + +- AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Debug programs" user right, this is a finding: + +- Administrators + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeDebugPrivilege" user right, this is a finding: + +S-1-5-32-544 (Administrators) + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN19-00-000050) and required frequency of changes (WN19-00-000060). + +Passwords for application accounts with this user right must be protected as highly privileged accounts.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000110Windows Server 2019 Force shutdown from a remote system user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Force shutdown from a remote system" user right can remotely shut down a system, which could result in a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Force shutdown from a remote system" to include only the following accounts or groups: + +- AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Force shutdown from a remote system" user right, this is a finding: + +- Administrators + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeRemoteShutdownPrivilege" user right, this is a finding: + +S-1-5-32-544 (Administrators)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000120Windows Server 2019 Generate security audits user right must only be assigned to Local Service and Network Service.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Generate security audits" user right specifies users and processes that can generate Security Log audit records, which must only be the system service accounts defined.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Generate security audits" to include only the following accounts or groups: + +- Local Service +- Network ServiceVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Generate security audits" user right, this is a finding: + +- Local Service +- Network Service + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeAuditPrivilege" user right, this is a finding: + +S-1-5-19 (Local Service) +S-1-5-20 (Network Service) + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN19-00-000050) and required frequency of changes (WN19-00-000060).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000130Windows Server 2019 Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Impersonate a client after authentication" user right allows a program to impersonate another user or account to run on their behalf. An attacker could use this to elevate privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Impersonate a client after authentication" to include only the following accounts or groups: + +- Administrators +- Service +- Local Service +- Network ServiceVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Impersonate a client after authentication" user right, this is a finding: + +- Administrators +- Service +- Local Service +- Network Service + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeImpersonatePrivilege" user right, this is a finding: + +S-1-5-32-544 (Administrators) +S-1-5-6 (Service) +S-1-5-19 (Local Service) +S-1-5-20 (Network Service) + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN19-00-000050) and required frequency of changes (WN19-00-000060).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000140Windows Server 2019 Increase scheduling priority: user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Increase scheduling priority" user right can change a scheduling priority, causing performance issues or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Increase scheduling priority" to include only the following accounts or groups: + +- AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Increase scheduling priority" user right, this is a finding: + +- Administrators + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeIncreaseBasePriorityPrivilege" user right, this is a finding: + +S-1-5-32-544 (Administrators) + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN19-00-000050) and required frequency of changes (WN19-00-000060).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000150Windows Server 2019 Load and unload device drivers user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Load and unload device drivers" user right allows a user to load device drivers dynamically on a system. This could be used by an attacker to install malicious code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Load and unload device drivers" to include only the following accounts or groups: + +- AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Load and unload device drivers" user right, this is a finding: + +- Administrators + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeLoadDriverPrivilege" user right, this is a finding: + +S-1-5-32-544 (Administrators)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000160Windows Server 2019 Lock pages in memory user right must not be assigned to any groups or accounts.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Lock pages in memory" user right allows physical memory to be assigned to processes, which could cause performance issues or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Lock pages in memory" to be defined but containing no entries (blank).Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Lock pages in memory" user right, this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs are granted the "SeLockMemoryPrivilege" user right, this is a finding. + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN19-00-000050) and required frequency of changes (WN19-00-000060).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000180Windows Server 2019 Modify firmware environment values user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Modify firmware environment values" user right can change hardware configuration environment variables. This could result in hardware failures or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Modify firmware environment values" to include only the following accounts or groups: + +- AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Modify firmware environment values" user right, this is a finding: + +- Administrators + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeSystemEnvironmentPrivilege" user right, this is a finding: + +S-1-5-32-544 (Administrators)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000190Windows Server 2019 Perform volume maintenance tasks user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Perform volume maintenance tasks" user right can manage volume and disk configurations. This could be used to delete volumes, resulting in data loss or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Perform volume maintenance tasks" to include only the following accounts or groups: + +- AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Perform volume maintenance tasks" user right, this is a finding: + +- Administrators + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeManageVolumePrivilege" user right, this is a finding: + +S-1-5-32-544 (Administrators)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000200Windows Server 2019 Profile single process user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Profile single process" user right can monitor non-system processes performance. An attacker could use this to identify processes to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Profile single process" to include only the following accounts or groups: + +- AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Profile single process" user right, this is a finding: + +- Administrators + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeProfileSingleProcessPrivilege" user right, this is a finding: + +S-1-5-32-544 (Administrators)SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000210Windows Server 2019 Restore files and directories user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Restore files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data. It could also be used to overwrite more current data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Restore files and directories" to include only the following accounts or groups: + +- AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Restore files and directories" user right, this is a finding: + +- Administrators + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeRestorePrivilege" user right, this is a finding: + +S-1-5-32-544 (Administrators) + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN19-00-000050) and required frequency of changes (WN19-00-000060).SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>WN19-UR-000220Windows Server 2019 Take ownership of files or other objects user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Take ownership of files or other objects" user right can take ownership of objects and make changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002235Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Take ownership of files or other objects" to include only the following accounts or groups: + +- AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Take ownership of files or other objects" user right, this is a finding: + +- Administrators + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeTakeOwnershipPrivilege" user right, this is a finding: + +S-1-5-32-544 (Administrators) + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN19-00-000050) and required frequency of changes (WN19-00-000060).SRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-AU-000090Windows Server 2019 must be configured to audit Account Management - Other Account Management Events successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Other Account Management Events records events such as the access of a password hash or the Password Policy Checking API being called. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Other Account Management Events" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding: + +Account Management >> Other Account Management Events - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-AU-000140Windows Server 2019 must be configured to audit Detailed Tracking - Process Creation successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Process Creation records events related to the creation of a process and the source. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000471-GPOS-00215</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> "Audit Process Creation" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Detailed Tracking >> Process Creation - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-AU-000260Windows Server 2019 must be configured to audit Policy Change - Audit Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Policy Change records events related to changes in audit policy. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Audit Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Policy Change >> Audit Policy Change - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-AU-000270Windows Server 2019 must be configured to audit Policy Change - Audit Policy Change failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Policy Change records events related to changes in audit policy. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Audit Policy Change" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Policy Change >> Audit Policy Change - FailureSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-AU-000280Windows Server 2019 must be configured to audit Policy Change - Authentication Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Authentication Policy Change records events related to changes in authentication policy, including Kerberos policy and Trust changes. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Authentication Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Policy Change >> Authentication Policy Change - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-AU-000290Windows Server 2019 must be configured to audit Policy Change - Authorization Policy Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Authorization Policy Change records events related to changes in user rights, such as "Create a token object". + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> "Audit Authorization Policy Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Policy Change >> Authorization Policy Change - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-AU-000300Windows Server 2019 must be configured to audit Privilege Use - Sensitive Privilege Use successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs". + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> "Audit Sensitive Privilege Use" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Privilege Use >> Sensitive Privilege Use - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-AU-000310Windows Server 2019 must be configured to audit Privilege Use - Sensitive Privilege Use failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs". + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Privilege Use >> "Audit Sensitive Privilege Use" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Privilege Use >> Sensitive Privilege Use - FailureSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-AU-000320Windows Server 2019 must be configured to audit System - IPsec Driver successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +IPsec Driver records events related to the IPsec Driver, such as dropped packets. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit IPsec Driver" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> IPsec Driver - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-AU-000330Windows Server 2019 must be configured to audit System - IPsec Driver failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +IPsec Driver records events related to the IPsec Driver, such as dropped packets. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit IPsec Driver" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> IPsec Driver - FailureSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-AU-000340Windows Server 2019 must be configured to audit System - Other System Events successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Other System Events" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> Other System Events - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-AU-000350Windows Server 2019 must be configured to audit System - Other System Events failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Other System Events" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> Other System Events - FailureSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-AU-000360Windows Server 2019 must be configured to audit System - Security State Change successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Security State Change records events related to changes in the security state, such as startup and shutdown of the system. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Security State Change" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> Security State Change - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-AU-000370Windows Server 2019 must be configured to audit System - Security System Extension successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Security System Extension records events related to extension code being loaded by the security subsystem. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit Security System Extension" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> Security System Extension - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-AU-000380Windows Server 2019 must be configured to audit System - System Integrity successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +System Integrity records events related to violations of integrity to the security subsystem. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit System Integrity" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> System Integrity - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-AU-000390Windows Server 2019 must be configured to audit System - System Integrity failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +System Integrity records events related to violations of integrity to the security subsystem. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> System >> "Audit System Integrity" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> System Integrity - FailureSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-DC-000170Windows Server 2019 Active Directory Group Policy objects must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes Group Policy objects. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the audit settings for Group Policy objects to include the following: + +This can be done at the Policy level in Active Directory to apply to all group policies. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Select "Advanced Features" from the "View" Menu. + +Navigate to [Domain] >> System >> Policies in the left panel. + +Right click "Policies", select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button. + +Select the "Auditing" tab. + +Type - Fail +Principal - Everyone +Access - Full Control +Applies to - This object and all descendant objects or Descendant groupPolicyContainer objects + +The three Success types listed below are defaults inherited from the Parent Object. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. + +Type - Success +Principal - Everyone +Access - Special (Permissions: Write all properties, Modify permissions; Properties: all "Write" type selected) +Inherited from - Parent Object +Applies to - Descendant groupPolicyContainer objects + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions) +Inherited from - Parent Object +Applies to - Descendant Organization Unit ObjectsThis applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for all Group Policy objects. + +Open "Group Policy Management" (available from various menus or run "gpmc.msc"). + +Navigate to "Group Policy Objects" in the domain being reviewed (Forest >> Domains >> Domain). + +For each Group Policy object: + +Select the Group Policy object item in the left pane. + +Select the "Delegation" tab in the right pane. + +Select the "Advanced" button. + +Select the "Advanced" button again and then the "Auditing" tab. + +If the audit settings for any Group Policy object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Applies to - This object and all descendant objects or Descendant groupPolicyContainer objects + +The three Success types listed below are defaults inherited from the Parent Object. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. + +Type - Success +Principal - Everyone +Access - Special (Permissions: Write all properties, Modify permissions; Properties: all "Write" type selected) +Inherited from - Parent Object +Applies to - Descendant groupPolicyContainer objects + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions) +Inherited from - Parent Object +Applies to - Descendant Organization Unit ObjectsSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-DC-000180Windows Server 2019 Active Directory Domain object must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select the domain being reviewed in the left pane. + +Right-click the domain name and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +Configure the audit settings for Domain object to include the following: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - None +Applies to - Special + +Type - Success +Principal - Domain Users +Access - All extended rights +Inherited from - None +Applies to - This object only + +Type - Success +Principal - Administrators +Access - All extended rights +Inherited from - None +Applies to - This object only + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner.)This applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for the Domain object. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select the domain being reviewed in the left pane. + +Right-click the domain name and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +If the audit settings on the Domain object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - None +Applies to - Special + +Type - Success +Principal - Domain Users +Access - All extended rights +Inherited from - None +Applies to - This object only + +Type - Success +Principal - Administrators +Access - All extended rights +Inherited from - None +Applies to - This object only + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner)SRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-DC-000190Windows Server 2019 Active Directory Infrastructure object must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Infrastructure object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select the domain being reviewed in the left pane. + +Right-click the "Infrastructure" object in the right pane and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +Configure the audit settings for Infrastructure object to include the following: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master) + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain)This applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for Infrastructure object. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select the domain being reviewed in the left pane. + +Right-click the "Infrastructure" object in the right pane and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +If the audit settings on the Infrastructure object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master) + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain)SRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-DC-000200Windows Server 2019 Active Directory Domain Controllers Organizational Unit (OU) object must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain Controller OU object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select the "Domain Controllers OU" under the domain being reviewed in the left pane. + +Right-click the "Domain Controllers OU" object and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +Configure the audit settings for Domain Controllers OU object to include the following: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: all create, delete and modify permissions) + +Type - Success +Principal - Everyone +Access - Write all properties +Inherited from - None +Applies to - This object and all descendant objects + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objectsThis applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for the Domain Controller OU object. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select the "Domain Controllers OU" under the domain being reviewed in the left pane. + +Right-click the "Domain Controllers OU" object and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +If the audit settings on the Domain Controllers OU object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object and all descendant objects + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: all create, delete and modify permissions) + +Type - Success +Principal - Everyone +Access - Write all properties +Inherited from - None +Applies to - This object and all descendant objects + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objectsSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-DC-000210Windows Server 2019 Active Directory AdminSDHolder object must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the AdminSDHolder object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select "System" under the domain being reviewed in the left pane. + +Right-click the "AdminSDHolder" object in the right pane and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +Configure the audit settings for AdminSDHolder object to include the following: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Write all properties, Modify permissions, Modify owner) + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objectsThis applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for the "AdminSDHolder" object. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select "System" under the domain being reviewed in the left pane. + +Right-click the "AdminSDHolder" object in the right pane and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +If the audit settings on the "AdminSDHolder" object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Write all properties, Modify permissions, Modify owner) + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objectsSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-DC-000220Windows Server 2019 Active Directory RID Manager$ object must be configured with proper audit settings.<VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the RID Manager$ object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select "System" under the domain being reviewed in the left pane. + +Right-click the "RID Manager$" object in the right pane and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +Configure the audit settings for RID Manager$ object to include the following: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None + (Access - Special = Write all properties, All extended rights, Change RID master) + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain)This applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for the "RID Manager$" object. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select "System" under the domain being reviewed in the left pane. + +Right-click the "RID Manager$" object in the right pane and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +If the audit settings on the "RID Manager$" object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None + (Access - Special = Write all properties, All extended rights, Change RID master) + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain)SRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-DC-000240Windows Server 2019 must be configured to audit DS Access - Directory Service Access successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Directory Service Access records events related to users accessing an Active Directory object. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> DS Access >> "Directory Service Access" with "Success" selected.This applies to domain controllers. It is NA for other systems. + +Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +DS Access >> Directory Service Access - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-DC-000250Windows Server 2019 must be configured to audit DS Access - Directory Service Access failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Directory Service Access records events related to users accessing an Active Directory object. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> DS Access >> "Directory Service Access" with "Failure" selected.This applies to domain controllers. It is NA for other systems. + +Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +DS Access >> Directory Service Access - FailureSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-DC-000260Windows Server 2019 must be configured to audit DS Access - Directory Service Changes successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Directory Service Changes records events related to changes made to objects in Active Directory Domain Services. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> DS Access >> "Directory Service Changes" with "Success" selected.This applies to domain controllers. It is NA for other systems. + +Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +DS Access >> Directory Service Changes - SuccessSRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>WN19-DC-000270Windows Server 2019 must be configured to audit DS Access - Directory Service Changes failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Directory Service Changes records events related to changes made to objects in Active Directory Domain Services. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-002234Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> DS Access >> "Directory Service Changes" with "Failure" selected.This applies to domain controllers. It is NA for other systems. + +Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +DS Access >> Directory Service Changes - FailureSRG-OS-000021-GPOS-00005<GroupDescription></GroupDescription>WN19-AC-000020Windows Server 2019 must have the number of allowed bad logon attempts configured to three or less.<VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack while allowing for honest errors made during normal user logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000044Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout threshold" to "3" or fewer invalid logon attempts (excluding "0", which is unacceptable).Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. + +If the "Account lockout threshold" is "0" or more than "3" attempts, this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt + +If "LockoutBadCount" equals "0" or is greater than "3" in the file, this is a finding.SRG-OS-000021-GPOS-00005<GroupDescription></GroupDescription>WN19-AC-000030Windows Server 2019 must have the period of time before the bad logon counter is reset configured to 15 minutes or greater.<VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to "0". The smaller this value is, the less effective the account lockout feature will be in protecting the local system. + +Satisfies: SRG-OS-000021-GPOS-00005, SRG-OS-000329-GPOS-00128</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000044CCI-002238Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Reset account lockout counter after" to at least "15" minutes.Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. + +If the "Reset account lockout counter after" value is less than "15" minutes, this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt + +If "ResetLockoutCount" is less than "15" in the file, this is a finding.SRG-OS-000329-GPOS-00128<GroupDescription></GroupDescription>WN19-AC-000010Windows Server 2019 account lockout duration must be configured to 15 minutes or greater.<VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that an account will remain locked after the specified number of failed logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002238Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout duration" to "15" minutes or greater. + +A value of "0" is also acceptable, requiring an administrator to unlock the account.Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. + +If the "Account lockout duration" is less than "15" minutes (excluding "0"), this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt + +If "LockoutDuration" is less than "15" (excluding "0") in the file, this is a finding. + +Configuring this to "0", requiring an administrator to unlock the account, is more restrictive and is not a finding.SRG-OS-000023-GPOS-00006<GroupDescription></GroupDescription>WN19-SO-000130Windows Server 2019 required legal notice must be configured to display before console logon.<VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. + +Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000048CCI-000050CCI-001384CCI-001385CCI-001386CCI-001387CCI-001388Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive Logon: Message text for users attempting to log on" to the following: + +You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. + +By using this IS (which includes any device attached to this IS), you consent to the following conditions: + +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. + +-At any time, the USG may inspect and seize data stored on this IS. + +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. + +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. + +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: LegalNoticeText + +Value Type: REG_SZ +Value: See message text below + +You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. + +By using this IS (which includes any device attached to this IS), you consent to the following conditions: + +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. + +-At any time, the USG may inspect and seize data stored on this IS. + +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. + +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. + +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.SRG-OS-000023-GPOS-00006<GroupDescription></GroupDescription>WN19-SO-000140Windows Server 2019 title for legal banner dialog box must be configured with the appropriate text.<VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. + +Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000048CCI-001384CCI-001385CCI-001386CCI-001387CCI-001388Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive Logon: Message title for users attempting to log on" to "DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or an organization-defined equivalent. + +If an organization-defined title is used, it can in no case contravene or modify the language of the message text required in WN19-SO-000150.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: LegalNoticeCaption + +Value Type: REG_SZ +Value: See message title options below + +"DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or an organization-defined equivalent. + +If an organization-defined title is used, it can in no case contravene or modify the language of the banner text required in WN19-SO-000150. + +Automated tools may only search for the titles defined above. If an organization-defined title is used, a manual review will be required.SRG-OS-000062-GPOS-00031<GroupDescription></GroupDescription>WN19-SO-000050Windows Server 2019 must force audit policy subcategory settings to override audit policy category settings.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. +This setting allows administrators to enable more precise auditing capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000169Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: SCENoApplyLegacyAuditPolicy + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000470-GPOS-00214<GroupDescription></GroupDescription>WN19-AU-000070Windows Server 2019 must be configured to audit Account Logon - Credential Validation successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Credential Validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> "Audit Credential Validation" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Logon >> Credential Validation - SuccessSRG-OS-000470-GPOS-00214<GroupDescription></GroupDescription>WN19-AU-000080Windows Server 2019 must be configured to audit Account Logon - Credential Validation failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Credential Validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> "Audit Credential Validation" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Logon >> Credential Validation - FailureSRG-OS-000474-GPOS-00219<GroupDescription></GroupDescription>WN19-AU-000130Windows Server 2019 must be configured to audit Detailed Tracking - Plug and Play Events successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Plug and Play activity records events related to the successful connection of external devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> "Audit PNP Activity" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Detailed Tracking >> Plug and Play Events - SuccessSRG-OS-000470-GPOS-00214<GroupDescription></GroupDescription>WN19-AU-000170Windows Server 2019 must be configured to audit Logon/Logoff - Group Membership successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Group Membership records information related to the group membership of a user's logon token.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Group Membership" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Group Membership - SuccessSRG-OS-000470-GPOS-00214<GroupDescription></GroupDescription>WN19-AU-000210Windows Server 2019 must be configured to audit Logon/Logoff - Special Logon successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Special Logon records special logons that have administrative privileges and can be used to elevate processes. + +Satisfies: SRG-OS-000470-GPOS-00214, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000475-GPOS-00220</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Special Logon" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Special Logon - SuccessSRG-OS-000470-GPOS-00214<GroupDescription></GroupDescription>WN19-AU-000220Windows Server 2019 must be configured to audit Object Access - Other Object Access Events successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Auditing for other object access records events related to the management of task scheduler jobs and COM+ objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Other Object Access Events" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Object Access >> Other Object Access Events - SuccessSRG-OS-000470-GPOS-00214<GroupDescription></GroupDescription>WN19-AU-000230Windows Server 2019 must be configured to audit Object Access - Other Object Access Events failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Auditing for other object access records events related to the management of task scheduler jobs and COM+ objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Other Object Access Events" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Object Access >> Other Object Access Events - FailureSRG-OS-000474-GPOS-00219<GroupDescription></GroupDescription>WN19-AU-000240Windows Server 2019 must be configured to audit Object Access - Removable Storage successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Object Access >> Removable Storage - Success + +Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.SRG-OS-000474-GPOS-00219<GroupDescription></GroupDescription>WN19-AU-000250Windows Server 2019 must be configured to audit Object Access - Removable Storage failures.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Object Access >> "Audit Removable Storage" with "Failure" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Object Access >> Removable Storage - Failure + +Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding.SRG-OS-000472-GPOS-00217<GroupDescription></GroupDescription>WN19-AU-000180Windows Server 2019 must be configured to audit logoff successes.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Logoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed. + +Satisfies: SRG-OS-000472-GPOS-00217, SRG-OS-000480-GPOS-00227</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000172CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logoff" with "Success" selected.Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Logoff - SuccessSRG-OS-000042-GPOS-00020<GroupDescription></GroupDescription>WN19-CC-000090Windows Server 2019 command line data must be included in process creation events.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Enabling "Include command line data for process creation events" will record the command line information with the process creation events in the log. This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000135Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Audit Process Creation >> "Include command line in process creation events" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ + +Value Name: ProcessCreationIncludeCmdLine_Enabled + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000042-GPOS-00020<GroupDescription></GroupDescription>WN19-CC-000460Windows Server 2019 PowerShell script block logging must be enabled.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Enabling PowerShell script block logging will record detailed information from the processing of PowerShell commands and scripts. This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000135Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows PowerShell >> "Turn on PowerShell Script Block Logging" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ + +Value Name: EnableScriptBlockLogging + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000341-GPOS-00132<GroupDescription></GroupDescription>WN19-CC-000270Windows Server 2019 Application event log size must be configured to 32768 KB or greater.<VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001849Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Application >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater.If the system is configured to write events directly to an audit server, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Application\ + +Value Name: MaxSize + +Type: REG_DWORD +Value: 0x00008000 (32768) (or greater)SRG-OS-000341-GPOS-00132<GroupDescription></GroupDescription>WN19-CC-000280Windows Server 2019 Security event log size must be configured to 196608 KB or greater.<VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001849Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> Security >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "196608" or greater.If the system is configured to write events directly to an audit server, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Security\ + +Value Name: MaxSize + +Type: REG_DWORD +Value: 0x00030000 (196608) (or greater)SRG-OS-000341-GPOS-00132<GroupDescription></GroupDescription>WN19-CC-000290Windows Server 2019 System event log size must be configured to 32768 KB or greater.<VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001849Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Event Log Service >> System >> "Specify the maximum log file size (KB)" to "Enabled" with a "Maximum Log Size (KB)" of "32768" or greater.If the system is configured to write events directly to an audit server, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\System\ + +Value Name: MaxSize + +Type: REG_DWORD +Value: 0x00008000 (32768) (or greater)SRG-OS-000342-GPOS-00133<GroupDescription></GroupDescription>WN19-AU-000010Windows Server 2019 audit records must be backed up to a different system or media than the system being audited.<VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001851Establish and implement a process for backing up log data to another system or media other than the system being audited.Determine if a process to back up log data to a different system or media than the system being audited has been implemented. + +If it has not, this is a finding.SRG-OS-000479-GPOS-00224<GroupDescription></GroupDescription>WN19-AU-000020Windows Server 2019 must, at a minimum, off-load audit records of interconnected systems in real time and off-load standalone systems weekly.<VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001851Configure the system to, at a minimum, off-load audit records of interconnected systems in real time and off-load standalone systems weekly.Verify the audit records, at a minimum, are off-loaded for interconnected systems in real time and off-loaded for standalone systems weekly. + +If they are not, this is a finding.SRG-OS-000355-GPOS-00143<GroupDescription></GroupDescription>WN19-00-000440The Windows Server 2019 time service must synchronize with an appropriate DoD time source.<VulnDiscussion>The Windows Time Service controls time synchronization settings. Time synchronization is essential for authentication and auditing purposes. If the Windows Time Service is used, it must synchronize with a secure, authorized time source. Domain-joined systems are automatically configured to synchronize with domain controllers. If an NTP server is configured, it must synchronize with a secure, authorized time source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001891Configure the system to synchronize time with an appropriate DoD time source. + +Domain-joined systems use NT5DS to synchronize time from other systems in the domain by default. + +If the system needs to be configured to an NTP server, configure the system to point to an authorized time server by setting the policy value for Computer Configuration >> Administrative Templates >> System >> Windows Time Service >> Time Providers >> "Configure Windows NTP Client" to "Enabled", and configure the "NtpServer" field to point to an appropriate DoD time server. + +The US Naval Observatory operates stratum 1 time servers, identified at http://tycho.usno.navy.mil/ntp.html. Time synchronization will occur through a hierarchy of time servers down to the local level. Clients and lower-level servers will synchronize with an authorized time server in the hierarchy.Review the Windows time service configuration. + +Open an elevated "Command Prompt" (run as administrator). + +Enter "W32tm /query /configuration". + +Domain-joined systems (excluding the domain controller with the PDC emulator role): + +If the value for "Type" under "NTP Client" is not "NT5DS", this is a finding. + +Other systems: + +If systems are configured with a "Type" of "NTP", including standalone systems and the domain controller with the PDC Emulator role, and do not have a DoD time server defined for "NTPServer", this is a finding. + +To determine the domain controller with the PDC Emulator role: + +Open "PowerShell". + +Enter "Get-ADDomain | FT PDCEmulator".SRG-OS-000057-GPOS-00027<GroupDescription></GroupDescription>WN19-AU-000030Windows Server 2019 permissions for the Application event log must prevent access by non-privileged accounts.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Application event log may be susceptible to tampering if proper permissions are not applied. + +Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000162CCI-000163CCI-000164Configure the permissions on the Application event log file (Application.evtx) to prevent access by non-privileged accounts. The default permissions listed below satisfy this requirement: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. + +If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".Navigate to the Application event log file. + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. + +If the permissions for the "Application.evtx" file are not as restrictive as the default permissions listed below, this is a finding: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full ControlSRG-OS-000057-GPOS-00027<GroupDescription></GroupDescription>WN19-AU-000040Windows Server 2019 permissions for the Security event log must prevent access by non-privileged accounts.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Security event log may disclose sensitive information or be susceptible to tampering if proper permissions are not applied. + +Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000162CCI-000163CCI-000164Configure the permissions on the Security event log file (Security.evtx) to prevent access by non-privileged accounts. The default permissions listed below satisfy this requirement: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. + +If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".Navigate to the Security event log file. + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. + +If the permissions for the "Security.evtx" file are not as restrictive as the default permissions listed below, this is a finding: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full ControlSRG-OS-000057-GPOS-00027<GroupDescription></GroupDescription>WN19-AU-000050Windows Server 2019 permissions for the System event log must prevent access by non-privileged accounts.<VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The System event log may be susceptible to tampering if proper permissions are not applied. + +Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000162CCI-000163CCI-000164Configure the permissions on the System event log file (System.evtx) to prevent access by non-privileged accounts. The default permissions listed below satisfy this requirement: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. + +If the location of the logs has been changed, when adding Eventlog to the permissions, it must be entered as "NT Service\Eventlog".Navigate to the System event log file. + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. + +If the permissions for the "System.evtx" file are not as restrictive as the default permissions listed below, this is a finding: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full ControlSRG-OS-000257-GPOS-00098<GroupDescription></GroupDescription>WN19-AU-000060Windows Server 2019 Event Viewer must be protected from unauthorized modification and deletion.<VulnDiscussion>Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. + +Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order to make access decisions regarding the modification or deletion of audit tools. + +Satisfies: SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001494CCI-001495Configure the permissions on the "Eventvwr.exe" file to prevent modification by any groups or accounts other than TrustedInstaller. The default permissions listed below satisfy this requirement: + +TrustedInstaller - Full Control +Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES, ALL RESTRICTED APPLICATION PACKAGES - Read & Execute + +The default location is the "%SystemRoot%\System32" folder.Navigate to "%SystemRoot%\System32". + +View the permissions on "Eventvwr.exe". + +If any groups or accounts other than TrustedInstaller have "Full control" or "Modify" permissions, this is a finding. + +The default permissions below satisfy this requirement: + +TrustedInstaller - Full Control +Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES, ALL RESTRICTED APPLICATION PACKAGES - Read & ExecuteSRG-OS-000057-GPOS-00027<GroupDescription></GroupDescription>WN19-UR-000170Windows Server 2019 Manage auditing and security log user right must only be assigned to the Administrators group.<VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Manage auditing and security log" user right can manage the security log and change auditing configurations. This could be used to clear evidence of tampering. + +Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000063-GPOS-00032, SRG-OS-000337-GPOS-00129</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000162CCI-000163CCI-000164CCI-000171CCI-001914Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Manage auditing and security log" to include only the following accounts or groups: + +- AdministratorsVerify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Manage auditing and security log" user right, this is a finding. + +- Administrators + +For server core installations, run the following command: + +Secedit /Export /Areas User_Rights /cfg c:\path\filename.txt + +Review the text file. + +If any SIDs other than the following are granted the "SeSecurityPrivilege" user right, this is a finding: + +S-1-5-32-544 (Administrators) + +If the organization has an Auditors group, the assignment of this group to the user right would not be a finding. + +If an application requires this user right, this would not be a finding. + +Vendor documentation must support the requirement for having the user right. + +The requirement must be documented with the ISSO. + +The application account must meet requirements for application account passwords, such as length (WN19-00-000050) and required frequency of changes (WN19-00-000060).SRG-OS-000362-GPOS-00149<GroupDescription></GroupDescription>WN19-CC-000420Windows Server 2019 must prevent users from changing installation options.<VulnDiscussion>Installation options for applications are typically controlled by administrators. This setting prevents users from changing installation options that may bypass security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001812Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Allow user control over installs" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ + +Value Name: EnableUserControl + +Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000362-GPOS-00149<GroupDescription></GroupDescription>WN19-CC-000430Windows Server 2019 must disable the Windows Installer Always install with elevated privileges option.<VulnDiscussion>Standard user accounts must not be granted elevated privileges. Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001812Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Always install with elevated privileges" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ + +Value Name: AlwaysInstallElevated + +Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000363-GPOS-00150<GroupDescription></GroupDescription>WN19-00-000220Windows Server 2019 system files must be monitored for unauthorized changes.<VulnDiscussion>Monitoring system files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001744Monitor the system for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis. This can be done with the use of various monitoring tools.Determine whether the system is monitored for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis. + +If system files are not monitored for unauthorized changes, this is a finding. + +A properly configured HBSS Policy Auditor 5.2 or later File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-00-000030Windows Server 2019 administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.<VulnDiscussion>Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account. + +Since administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy require administrative accounts to not access the Internet or use applications such as email. + +The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. + +Whitelisting can be used to enforce the policy to ensure compliance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Establish a policy, at minimum, to prohibit administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. Ensure the policy is enforced. + +The organization may use technical means such as whitelisting to prevent the use of browsers and mail applications to enforce this requirement.Determine whether organization policy, at a minimum, prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. + +If it does not, this is a finding. + +The organization may use technical means such as whitelisting to prevent the use of browsers and mail applications to enforce this requirement.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-00-000040Windows Server 2019 members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks.<VulnDiscussion>Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Members of the Backup Operators group must have separate logon accounts for performing backup duties.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure each member of the Backup Operators group has separate accounts for backup functions and standard user functions.If no accounts are members of the Backup Operators group, this is NA. + +Verify users with accounts in the Backup Operators group have a separate user account for backup functions and for performing normal user tasks. + +If users with accounts in the Backup Operators group do not have separate accounts for backup functions and standard user functions, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-00-000060Windows Server 2019 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.<VulnDiscussion>Setting application account passwords to expire may cause applications to stop functioning. However, not changing them on a regular basis exposes them to attack. If managed service accounts are used, this alleviates the need to manually change application account passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Change passwords for manually managed application/service accounts at least annually or when an administrator with knowledge of the password leaves the organization. + +It is recommended that system-managed service accounts be used whenever possible.Determine if manually managed application/service accounts exist. If none exist, this is NA. + +If passwords for manually managed application/service accounts are not changed at least annually or when an administrator with knowledge of the password leaves the organization, this is a finding. + +Identify manually managed application/service accounts. + +To determine the date a password was last changed: + +Domain controllers: + +Open "PowerShell". + +Enter "Get-AdUser -Identity [application account name] -Properties PasswordLastSet | FT Name, PasswordLastSet", where [application account name] is the name of the manually managed application/service account. + +If the "PasswordLastSet" date is more than one year old, this is a finding. + + +Member servers and standalone systems: + +Open "Command Prompt". + +Enter 'Net User [application account name] | Find /i "Password Last Set"', where [application account name] is the name of the manually managed application/service account. + +If the "Password Last Set" date is more than one year old, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-DC-000430The password for the krbtgt account on a domain must be reset at least every 180 days.<VulnDiscussion>The krbtgt account acts as a service account for the Kerberos Key Distribution Center (KDC) service. The account and password are created when a domain is created and the password is typically not changed. If the krbtgt account is compromised, attackers can create valid Kerberos Ticket Granting Tickets (TGT). + +The password must be changed twice to effectively remove the password history. Changing once, waiting for replication to complete and changing again reduces the risk of issues. Changing twice in rapid succession forces clients to re-authenticate (including application services) but is desired if a compromise is suspected.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Reset the password for the krbtgt account a least every 180 days. The password must be changed twice to effectively remove the password history. Changing once, waiting for replication to complete and changing again reduces the risk of issues. Changing twice in rapid succession forces clients to re-authenticate (including application services) but is desired if a compromise is suspected. + +PowerShell scripts are available to accomplish this such as at the following link: + +https://gallery.technet.microsoft.com/Reset-the-krbtgt-account-581a9e51 + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Select "Advanced Features" in the "View" menu if not previously selected. + +Select the "Users" node. + +Right click on the krbtgt account and select "Reset password" + +Enter a password that meets password complexity requirements. + +Clear the "User must change password at next logon" check box. + +The system will automatically change this to a system-generated complex password.This requirement is applicable to domain controllers; it is NA for other systems. + +Open "Windows PowerShell". + +Enter "Get-ADUser krbtgt -Property PasswordLastSet". + +If the "PasswordLastSet" date is more than 180 days old, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-00-000090Windows Server 2019 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.<VulnDiscussion>Credential Guard uses virtualization-based security to protect data that could be used in credential theft attacks if compromised. A number of system requirements must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure domain-joined systems have a TPM that is configured for use. (Versions 2.0 or 1.2 support Credential Guard.) + +The TPM must be enabled in the firmware. + +Run "tpm.msc" for configuration options in Windows.For standalone systems, this is NA. + +Current hardware and virtual environments may not support virtualization-based security features, including Credential Guard, due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within a virtual machine. + +Verify the system has a TPM and it is ready for use. + +Run "tpm.msc". + +Review the sections in the center pane. + +"Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has been taken". + +TPM Manufacturer Information - Specific Version = 2.0 or 1.2 + +If a TPM is not found or is not ready for use, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-00-000100Windows Server 2019 must be maintained at a supported servicing level.<VulnDiscussion>Systems at unsupported servicing levels will not receive security updates for new vulnerabilities, which leave them subject to exploitation. Systems must be maintained at a servicing level supported by the vendor with new security updates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Update the system to a Version 1809 (Build 17763.xxx) or greater.Open "Command Prompt". + +Enter "winver.exe". + +If the "About Windows" dialog box does not display "Microsoft Windows Server Version 1809 (Build 17763.xxx)" or greater, this is a finding. + +Preview versions must not be used in a production environment.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-00-000110Windows Server 2019 must use an anti-virus program.<VulnDiscussion>Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Install an anti-virus solution on the system.Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution. + +If there is no anti-virus solution installed on the system, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-00-000120Windows Server 2019 must have a host-based intrusion detection or prevention system.<VulnDiscussion>A properly configured Host-based Intrusion Detection System (HIDS) or Host-based Intrusion Prevention System (HIPS) provides another level of defense against unauthorized access to critical servers. With proper configuration and logging enabled, such a system can stop and/or alert for many attempts to gain unauthorized access to resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Install a HIDS or HIPS on each server.Determine whether there is a HIDS or HIPS on each server. + +If the HIPS component of HBSS is installed and active on the host and the alerts of blocked activity are being logged and monitored, this meets the requirement. + +A HIDS device is not required on a system that has the role as the Network Intrusion Device (NID). However, this exception needs to be documented with the ISSO. + +If a HIDS is not installed on the system, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-00-000240Windows Server 2019 must have software certificate installation files removed.<VulnDiscussion>Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Remove any certificate installation files (*.p12 and *.pfx) found on a system. + +Note: This does not apply to server-based applications that have a requirement for .p12 certificate files or Adobe PreFlight certificate files.Search all drives for *.p12 and *.pfx files. + +If any files with these extensions exist, this is a finding. + +This does not apply to server-based applications that have a requirement for .p12 certificate files or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-00-000420Windows Server 2019 FTP servers must be configured to prevent anonymous logons.<VulnDiscussion>The FTP service allows remote users to access shared files and directories. Allowing anonymous FTP connections makes user auditing difficult. + +Using accounts that have administrator privileges to log on to FTP risks that the userid and password will be captured on the network and give administrator access to an unauthorized user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the FTP service to prevent anonymous logons. + +Open "Internet Information Services (IIS) Manager". + +Select the server. + +Double-click "FTP Authentication". + +Select "Anonymous Authentication". + +Select "Disabled" under "Actions".If FTP is not installed on the system, this is NA. + +Open "Internet Information Services (IIS) Manager". + +Select the server. + +Double-click "FTP Authentication". + +If the "Anonymous Authentication" status is "Enabled", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-00-000430Windows Server 2019 FTP servers must be configured to prevent access to the system drive.<VulnDiscussion>The FTP service allows remote users to access shared files and directories that could provide access to system resources and compromise the system, especially if the user can gain access to the root directory of the boot drive.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the FTP sites to allow access only to specific FTP shared resources. Do not allow access to other areas of the system.If FTP is not installed on the system, this is NA. + +Open "Internet Information Services (IIS) Manager". + +Select "Sites" under the server name. + +For any sites with a Binding that lists FTP, right-click the site and select "Explore". + +If the site is not defined to a specific folder for shared FTP resources, this is a finding. + +If the site includes any system areas such as root of the drive, Program Files, or Windows directories, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-00-000450Windows Server 2019 must have orphaned security identifiers (SIDs) removed from user rights.<VulnDiscussion>Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups. If the account or group objects are reanimated, there is a potential they may still have rights no longer intended. Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Remove any unresolved SIDs found in User Rights assignments and determined to not be for currently valid accounts or groups by removing the accounts or groups from the appropriate group policy.Review the effective User Rights setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format that begins with "*S-1-".) + +If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding. + +For server core installations, run the following command: + +Secedit /export /areas USER_RIGHTS /cfg c:\path\UserRights.txt + +The results in the file identify user right assignments by SID instead of group name. Review the SIDs for unidentified ones. A list of typical SIDs \ Groups is below, search Microsoft for articles on well-known SIDs for others. + +If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding. + +SID - Group +S-1-5-11 - Authenticated Users +S-1-5-113 - Local account +S-1-5-114 - Local account and member of Administrators group +S-1-5-19 - Local Service +S-1-5-20 - Network Service +S-1-5-32-544 - Administrators +S-1-5-32-546 - Guests +S-1-5-6 - Service +S-1-5-9 - Enterprise Domain Controllers +S-1-5-domain-512 - Domain Admins +S-1-5-root domain-519 - Enterprise Admins +S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420 - NT Service\WdiServiceHostSRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-00-000460Windows Server 2019 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.<VulnDiscussion>UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in "Legacy BIOS" mode will not support these security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure UEFI firmware to run in "UEFI" mode, not "Legacy BIOS" mode.Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must run in "UEFI" mode. + +Verify the system firmware is configured to run in "UEFI" mode, not "Legacy BIOS". + +Run "System Information". + +Under "System Summary", if "BIOS Mode" does not display "UEFI", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-00-000470Windows Server 2019 must have Secure Boot enabled.<VulnDiscussion>Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Enable Secure Boot in the system firmware.Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled. + +Run "System Information". + +Under "System Summary", if "Secure Boot State" does not display "On", this is a finding. + +On server core installations, run the following PowerShell command: + +Confirm-SecureBootUEFI + +If a value of "True" is not returned, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-CC-000030Windows Server 2019 Internet Protocol version 6 (IPv6) source routing must be configured to the highest protection level to prevent IP source routing.<VulnDiscussion>Configuring the system to disable IPv6 source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing)" to "Enabled" with "Highest protection, source routing is completely disabled" selected. + +This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ + +Value Name: DisableIPSourceRouting + +Type: REG_DWORD +Value: 0x00000002 (2)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-CC-000040Windows Server 2019 source routing must be configured to the highest protection level to prevent Internet Protocol (IP) source routing.<VulnDiscussion>Configuring the system to disable IP source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)" to "Enabled" with "Highest protection, source routing is completely disabled" selected. + +This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ + +Value Name: DisableIPSourceRouting + +Value Type: REG_DWORD +Value: 0x00000002 (2)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-CC-000050Windows Server 2019 must be configured to prevent Internet Control Message Protocol (ICMP) redirects from overriding Open Shortest Path First (OSPF)-generated routes.<VulnDiscussion>Allowing ICMP redirect of routes can lead to traffic not being routed properly. When disabled, this forces ICMP to be routed via the shortest path first.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes" to "Disabled". + +This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ + +Value Name: EnableICMPRedirect + +Value Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-CC-000070Windows Server 2019 insecure logons to an SMB server must be disabled.<VulnDiscussion>Insecure guest logons allow unauthenticated access to shared folders. Shared resources on a system must require authentication to establish proper access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Lanman Workstation >> "Enable insecure guest logons" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation\ + +Value Name: AllowInsecureGuestAuth + +Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-CC-000080Windows Server 2019 hardened Universal Naming Convention (UNC) paths must be defined to require mutual authentication and integrity for at least the \\*\SYSVOL and \\*\NETLOGON shares.<VulnDiscussion>Additional security requirements are applied to UNC paths specified in hardened UNC paths before allowing access to them. This aids in preventing tampering with or spoofing of connections to these paths.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Network >> Network Provider >> "Hardened UNC Paths" to "Enabled" with at least the following configured in "Hardened UNC Paths" (click the "Show" button to display): + +Value Name: \\*\SYSVOL +Value: RequireMutualAuthentication=1, RequireIntegrity=1 + +Value Name: \\*\NETLOGON +Value: RequireMutualAuthentication=1, RequireIntegrity=1This requirement is applicable to domain-joined systems. For standalone systems, this is NA. + +If the following registry values do not exist or are not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\ + +Value Name: \\*\NETLOGON +Value Type: REG_SZ +Value: RequireMutualAuthentication=1, RequireIntegrity=1 + +Value Name: \\*\SYSVOL +Value Type: REG_SZ +Value: RequireMutualAuthentication=1, RequireIntegrity=1 + +Additional entries would not be a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-CC-000100Windows Server 2019 must be configured to enable Remote host allows delegation of non-exportable credentials.<VulnDiscussion>An exportable version of credentials is provided to remote hosts when using credential delegation which exposes them to theft on the remote host. Restricted Admin mode or Remote Credential Guard allow delegation of non-exportable credentials providing additional protection of the credentials. Enabling this configures the host to support Restricted Admin mode or Remote Credential Guard.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Credentials Delegation >> "Remote host allows delegation of non-exportable credentials" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\ + +Value Name: AllowProtectedCreds + +Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-CC-000110Windows Server 2019 virtualization-based security must be enabled with the platform security level configured to Secure Boot or Secure Boot with DMA Protection.<VulnDiscussion>Virtualization Based Security (VBS) provides the platform for the additional security features Credential Guard and virtualization-based protection of code integrity. Secure Boot is the minimum security level, with DMA protection providing additional memory protection. DMA Protection requires a CPU that supports input/output memory management unit (IOMMU).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> "Turn On Virtualization Based Security" to "Enabled" with "Secure Boot" or "Secure Boot and DMA Protection" selected. + +A Microsoft TechNet article on Credential Guard, including system requirement details, can be found at the following link: + +https://technet.microsoft.com/itpro/windows/keep-secure/credential-guardFor standalone systems, this is NA. + +Current hardware and virtual environments may not support virtualization-based security features, including Credential Guard, due to specific supporting requirements, including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within a virtual machine. + +Open "PowerShell" with elevated privileges (run as administrator). + +Enter the following: + +"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard" + +If "RequiredSecurityProperties" does not include a value of "2" indicating "Secure Boot" (e.g., "{1, 2}"), this is a finding. + +If "Secure Boot and DMA Protection" is configured, "3" will also be displayed in the results (e.g., "{1, 2, 3}"). + +If "VirtualizationBasedSecurityStatus" is not a value of "2" indicating "Running", this is a finding. + +Alternately: + +Run "System Information". + +Under "System Summary", verify the following: + +If "Device Guard Virtualization based security" does not display "Running", this is a finding. + +If "Device Guard Required Security Properties" does not display "Base Virtualization Support, Secure Boot", this is a finding. + +If "Secure Boot and DMA Protection" is configured, "DMA Protection" will also be displayed (e.g., "Base Virtualization Support, Secure Boot, DMA Protection"). + +The policy settings referenced in the Fix section will configure the following registry values. However, due to hardware requirements, the registry values alone do not ensure proper function. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ + +Value Name: EnableVirtualizationBasedSecurity +Value Type: REG_DWORD +Value: 0x00000001 (1) + +Value Name: RequirePlatformSecurityFeatures +Value Type: REG_DWORD +Value: 0x00000001 (1) (Secure Boot only) or 0x00000003 (3) (Secure Boot and DMA Protection) + +A Microsoft TechNet article on Credential Guard, including system requirement details, can be found at the following link: + +https://technet.microsoft.com/itpro/windows/keep-secure/credential-guardSRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-CC-000130Windows Server 2019 Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers identified as bad.<VulnDiscussion>Compromised boot drivers can introduce malware prior to protection mechanisms that load after initialization. The Early Launch Antimalware driver can limit allowed drivers based on classifications determined by the malware protection application. At a minimum, drivers determined to be bad must not be allowed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy to enforce "Good, unknown and bad but critical" (preventing "bad"). + +If this needs to be corrected or a more secure setting is desired, configure the policy value for Computer Configuration >> Administrative Templates >> System >> Early Launch Antimalware >> "Boot-Start Driver Initialization Policy" to "Not Configured" or "Enabled" with any option other than "All" selected.The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy to enforce "Good, unknown and bad but critical" (preventing "bad"). + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0x00000007 (7)", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Policies\EarlyLaunch\ + +Value Name: DriverLoadPolicy + +Value Type: REG_DWORD +Value: 0x00000001 (1), 0x00000003 (3), or 0x00000008 (8) (or if the Value Name does not exist) + +Possible values for this setting are: +8 - Good only +1 - Good and unknown +3 - Good, unknown and bad but critical +7 - All (which includes "bad" and would be a finding)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-CC-000140Windows Server 2019 group policy objects must be reprocessed even if they have not changed.<VulnDiscussion>Registry entries for group policy settings can potentially be changed from the required configuration. This could occur as part of troubleshooting or by a malicious process on a compromised system. Enabling this setting and then selecting the "Process even if the Group Policy objects have not changed" option ensures the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Group Policy >> "Configure registry policy processing" to "Enabled" with the option "Process even if the Group Policy objects have not changed" selected.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\ + +Value Name: NoGPOListChanges + +Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-CC-000180Windows Server 2019 users must be prompted to authenticate when the system wakes from sleep (on battery).<VulnDiscussion>A system that does not require authentication when resuming from sleep may provide access to unauthorized users. Authentication must always be required when accessing a system. This setting ensures users are prompted for a password when the system wakes from sleep (on battery).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Power Management >> Sleep Settings >> "Require a password when a computer wakes (on battery)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ + +Value Name: DCSettingIndex + +Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-CC-000190Windows Server 2019 users must be prompted to authenticate when the system wakes from sleep (plugged in).<VulnDiscussion>A system that does not require authentication when resuming from sleep may provide access to unauthorized users. Authentication must always be required when accessing a system. This setting ensures users are prompted for a password when the system wakes from sleep (plugged in).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Power Management >> Sleep Settings >> "Require a password when a computer wakes (plugged in)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ + +Value Name: ACSettingIndex + +Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-CC-000250Windows Server 2019 Telemetry must be configured to Security or Basic.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information from being sent outside the enterprise. The "Security" option for Telemetry configures the lowest amount of data, effectively none outside of the Malicious Software Removal Tool (MSRT), Defender, and telemetry client settings. "Basic" sends basic diagnostic and usage data and may be required to support some Microsoft services.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Data Collection and Preview Builds>> "Allow Telemetry" to "Enabled" with "0 - Security [Enterprise Only]" or "1 - Basic" selected in "Options".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DataCollection\ + +Value Name: AllowTelemetry + +Type: REG_DWORD +Value: 0x00000000 (0) (Security), 0x00000001 (1) (Basic)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-CC-000260Windows Server 2019 Windows Update must not obtain updates from other PCs on the Internet.<VulnDiscussion>Windows Update can obtain updates from additional sources instead of Microsoft. In addition to Microsoft, updates can be obtained from and sent to PCs on the local network as well as on the Internet. This is part of the Windows Update trusted process, however to minimize outside exposure, obtaining updates from or sending to systems on the Internet must be prevented.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Delivery Optimization >> "Download Mode" to "Enabled" with any option except "Internet" selected. + +Acceptable selections include: + +Bypass (100) +Group (2) +HTTP only (0) +LAN (1) +Simple (99)If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\ + +Value Name: DODownloadMode + +Value Type: REG_DWORD +Value: 0x00000000 (0) - No peering (HTTP Only) +0x00000001 (1) - Peers on same NAT only (LAN) +0x00000002 (2) - Local Network / Private group peering (Group) +0x00000063 (99) - Simple download mode, no peering (Simple) +0x00000064 (100) - Bypass mode, Delivery Optimization not used (Bypass) + +A value of 0x00000003 (3), Internet, is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-CC-000320Windows Server 2019 Turning off File Explorer heap termination on corruption must be disabled.<VulnDiscussion>Legacy plug-in applications may continue to function when a File Explorer session has become corrupt. Disabling this feature will prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366The default behavior is for File Explorer heap termination on corruption to be disabled. + +If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Turn off heap termination on corruption" to "Not Configured" or "Disabled".The default behavior is for File Explorer heap termination on corruption to be enabled. + +If the registry Value Name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ + +Value Name: NoHeapTerminationOnCorruption + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-CC-000330Windows Server 2019 File Explorer shell protocol must run in protected mode.<VulnDiscussion>The shell protocol will limit the set of folders that applications can open when run in protected mode. Restricting files an application can open to a limited set of folders increases the security of Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366The default behavior is for shell protected mode to be turned on for File Explorer. + +If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Turn off shell protocol protected mode" to "Not Configured" or "Disabled".The default behavior is for shell protected mode to be turned on for File Explorer. + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ + +Value Name: PreXPSP2ShellProtocolBehavior + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-CC-000390Windows Server 2019 must prevent attachments from being downloaded from RSS feeds.<VulnDiscussion>Attachments from RSS feeds may not be secure. This setting will prevent attachments from being downloaded from RSS feeds.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> RSS Feeds >> "Prevent downloading of enclosures" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds\ + +Value Name: DisableEnclosureDownload + +Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-CC-000440Windows Server 2019 users must be notified if a web-based program attempts to install software.<VulnDiscussion>Web-based programs may attempt to install malicious software on a system. Ensuring users are notified if a web-based program attempts to install software allows them to refuse the installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system. + +If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Prevent Internet Explorer security prompt for Windows Installer scripts" to "Not Configured" or "Disabled".The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system. + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ + +Value Name: SafeForScripting + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist)SRG-OS-000480-GPOS-00229<GroupDescription></GroupDescription>WN19-CC-000450Windows Server 2019 must disable automatically signing in the last interactive user after a system-initiated restart.<VulnDiscussion>Windows can be configured to automatically sign the user back in after a Windows Update restart. Some protections are in place to help ensure this is done in a secure fashion; however, disabling this will prevent the caching of credentials for this purpose and also ensure the user is aware of the restart.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Logon Options >> "Sign-in last interactive user automatically after a system-initiated restart" to "Disabled".Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: DisableAutomaticRestartSignOn + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-DC-000150Windows Server 2019 directory data (outside the root DSE) of a non-public directory must be configured to prevent anonymous access.<VulnDiscussion>To the extent that anonymous access to directory data (outside the root DSE) is permitted, read access control of the data is effectively disabled. If other means of controlling access (such as network restrictions) are compromised, there may be nothing else to protect the confidentiality of sensitive directory data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure directory data (outside the root DSE) of a non-public directory to prevent anonymous access. + +For AD, there are multiple configuration items that could enable anonymous access. + +Changing the access permissions on the domain naming context object (from the secure defaults) could enable anonymous access. If the check procedures indicate this is the cause, the process that was used to change the permissions should be reversed. This could have been through the Windows Support Tools ADSI Edit console (adsiedit.msc). + +The dsHeuristics option is used. This is addressed in check V-8555 in the AD Forest STIG.This applies to domain controllers. It is NA for other systems. + +Open "Command Prompt" (not elevated). + +Run "ldp.exe". + +From the "Connection menu", select "Bind". + +Clear the User, Password, and Domain fields. + +Select "Simple bind" for the Bind type and click "OK". + +Confirmation of anonymous access will be displayed at the end: + +res = ldap_simple_bind_s +Authenticated as: 'NT AUTHORITY\ANONYMOUS LOGON' + +From the "Browse" menu, select "Search". + +In the Search dialog, enter the DN of the domain naming context (generally something like "dc=disaost,dc=mil") in the Base DN field. + +Clear the Attributes field and select "Run". + +Error messages should display related to Bind and user not authenticated. + +If attribute data is displayed, anonymous access is enabled to the domain naming context and this is a finding. + +The following network controls allow the finding severity to be downgraded to a CAT II since these measures lower the risk associated with anonymous access. + +Network hardware ports at the site are subject to 802.1x authentication or MAC address restrictions. + +Premise firewall or host restrictions prevent access to ports 389, 636, 3268, and 3269 from client hosts not explicitly identified by domain (.mil) or IP address.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-DC-000330Windows Server 2019 domain controllers must be configured to allow reset of machine account passwords.<VulnDiscussion>Enabling this setting on all domain controllers in a domain prevents domain members from changing their computer account passwords. If these passwords are weak or compromised, the inability to change them may leave these computers vulnerable.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain controller: Refuse machine account password changes" to "Disabled".This applies to domain controllers. It is NA for other systems. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: RefusePasswordChange + +Value Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-MS-000050Windows Server 2019 must limit the caching of logon credentials to four or less on domain-joined member servers.<VulnDiscussion>The default Windows configuration caches the last logon credentials for users who log on interactively to a system. This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable. Even though the credential cache is well protected, if a system is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive Logon: Number of previous logons to cache (in case Domain Controller is not available)" to "4" logons or less.This applies to member servers. For domain controllers and standalone systems, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ + +Value Name: CachedLogonsCount + +Value Type: REG_SZ +Value: 4 (or less)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-MS-000140Windows Server 2019 must be running Credential Guard on domain-joined member servers.<VulnDiscussion>Credential Guard uses virtualization-based security to protect data that could be used in credential theft attacks if compromised. This authentication information, which was stored in the Local Security Authority (LSA) in previous versions of Windows, is isolated from the rest of operating system and can only be accessed by privileged system software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Device Guard >> "Turn On Virtualization Based Security" to "Enabled" with "Enabled with UEFI lock" selected for "Credential Guard Configuration". + +A Microsoft article on Credential Guard system requirement can be found at the following link: + +https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-requirementsFor domain controllers and standalone systems, this is NA. + +Current hardware and virtual environments may not support virtualization-based security features, including Credential Guard, due to specific supporting requirements, including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within a virtual machine. + +Open "PowerShell" with elevated privileges (run as administrator). + +Enter the following: + +"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard" + +If "SecurityServicesRunning" does not include a value of "1" (e.g., "{1, 2}"), this is a finding. + +Alternately: + +Run "System Information". + +Under "System Summary", verify the following: + +If "Device Guard Security Services Running" does not list "Credential Guard", this is a finding. + +The policy settings referenced in the Fix section will configure the following registry value. However, due to hardware requirements, the registry value alone does not ensure proper function. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ + +Value Name: LsaCfgFlags +Value Type: REG_DWORD +Value: 0x00000001 (1) (Enabled with UEFI lock) + +A Microsoft article on Credential Guard system requirement can be found at the following link: + +https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-requirementsSRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-SO-000020Windows Server 2019 must prevent local accounts with blank passwords from being used from the network.<VulnDiscussion>An account without a password can allow unauthorized access to a system as only the username would be required. Password policies should prevent accounts with blank passwords from existing on a system. However, if a local account with a blank password does exist, enabling this setting will prevent network access, limiting the account to local console logon only.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Limit local account use of blank passwords to console logon only" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: LimitBlankPasswordUse + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-SO-000030Windows Server 2019 built-in administrator account must be renamed.<VulnDiscussion>The built-in administrator account is a well-known account subject to attack. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Rename administrator account" to a name other than "Administrator".Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. + +If the value for "Accounts: Rename administrator account" is not set to a value other than "Administrator", this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt + +If "NewAdministratorName" is not something other than "Administrator" in the file, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-SO-000040Windows Server 2019 built-in guest account must be renamed.<VulnDiscussion>The built-in guest account is a well-known user account on all Windows systems and, as initially installed, does not require a password. This can allow access to system resources by unauthorized users. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Rename guest account" to a name other than "Guest".Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. + +If the value for "Accounts: Rename guest account" is not set to a value other than "Guest", this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt + +If "NewGuestName" is not something other than "Guest" in the file, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-SO-000100Windows Server 2019 maximum age for machine account passwords must be configured to 30 days or less.<VulnDiscussion>Computer account passwords are changed automatically on a regular basis. This setting controls the maximum password age that a machine account may have. This must be set to no more than 30 days, ensuring the machine changes its password monthly.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366This is the default configuration for this setting (30 days). + +Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Maximum machine account password age" to "30" or less (excluding "0", which is unacceptable).This is the default configuration for this setting (30 days). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: MaximumPasswordAge + +Value Type: REG_DWORD +Value: 0x0000001e (30) (or less, but not 0)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-SO-000150Windows Server 2019 Smart Card removal option must be configured to Force Logoff or Lock Workstation.<VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked. Configuring a system to lock when a smart card is removed will ensure the system is inaccessible when unattended.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Interactive logon: Smart card removal behavior" to "Lock Workstation" or "Force Logoff".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ + +Value Name: scremoveoption + +Value Type: REG_SZ +Value: 1 (Lock Workstation) or 2 (Force Logoff) + +If configuring this on servers causes issues, such as terminating users' remote sessions, and the organization has a policy in place that any other sessions on the servers, such as administrative console logons, are manually locked or logged off when unattended or not in use, this would be acceptable. This must be documented with the ISSO.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-SO-000210Windows Server 2019 must not allow anonymous SID/Name translation.<VulnDiscussion>Allowing anonymous SID/Name translation can provide sensitive information for accessing a system. Only authorized users must be able to perform such translations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Allow anonymous SID/Name translation" to "Disabled".Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. + +If the value for "Network access: Allow anonymous SID/Name translation" is not set to "Disabled", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-SO-000220Windows Server 2019 must not allow anonymous enumeration of Security Account Manager (SAM) accounts.<VulnDiscussion>Anonymous enumeration of SAM accounts allows anonymous logon users (null session connections) to list all accounts names, thus providing a list of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Do not allow anonymous enumeration of SAM accounts" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: RestrictAnonymousSAM + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-SO-000240Windows Server 2019 must be configured to prevent anonymous users from having the same permissions as the Everyone group.<VulnDiscussion>Access by anonymous users must be restricted. If this setting is enabled, anonymous users have the same rights and permissions as the built-in Everyone group. Anonymous users must not have these permissions or rights.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Let Everyone permissions apply to anonymous users" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: EveryoneIncludesAnonymous + +Value Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-SO-000260Windows Server 2019 services using Local System that use Negotiate when reverting to NTLM authentication must use the computer identity instead of authenticating anonymously.<VulnDiscussion>Services using Local System that use Negotiate when reverting to NTLM authentication may gain unauthorized access if allowed to authenticate anonymously versus using the computer identity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Allow Local System to use computer identity for NTLM" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\ + +Value Name: UseMachineId + +Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-SO-000270Windows Server 2019 must prevent NTLM from falling back to a Null session.<VulnDiscussion>NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Allow LocalSystem NULL session fallback" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\MSV1_0\ + +Value Name: allownullsessionfallback + +Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-SO-000280Windows Server 2019 must prevent PKU2U authentication using online identities.<VulnDiscussion>PKU2U is a peer-to-peer authentication protocol. This setting prevents online identities from authenticating to domain-joined systems. Authentication will be centrally managed with Windows user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Allow PKU2U authentication requests to this computer to use online identities" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\pku2u\ + +Value Name: AllowOnlineID + +Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-SO-000310Windows Server 2019 LAN Manager authentication level must be configured to send NTLMv2 response only and to refuse LM and NTLM.<VulnDiscussion>The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts. NTLM, which is less secure, is retained in later Windows versions for compatibility with clients and servers that are running earlier versions of Windows or applications that still use it. It is also used to authenticate logons to standalone computers that are running later versions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: LAN Manager authentication level" to "Send NTLMv2 response only. Refuse LM & NTLM".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: LmCompatibilityLevel + +Value Type: REG_DWORD +Value: 0x00000005 (5)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-SO-000320Windows Server 2019 must be configured to at least negotiate signing for LDAP client signing.<VulnDiscussion>This setting controls the signing requirements for LDAP clients. This must be set to "Negotiate signing" or "Require signing", depending on the environment and type of LDAP server in use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: LDAP client signing requirements" to "Negotiate signing" at a minimum.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LDAP\ + +Value Name: LDAPClientIntegrity + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-SO-000330Windows Server 2019 session security for NTLM SSP-based clients must be configured to require NTLMv2 session security and 128-bit encryption.<VulnDiscussion>Microsoft has implemented a variety of security support providers for use with Remote Procedure Call (RPC) sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Minimum session security for NTLM SSP based (including secure RPC) clients" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected).If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ + +Value Name: NTLMMinClientSec + +Value Type: REG_DWORD +Value: 0x20080000 (537395200)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-SO-000340Windows Server 2019 session security for NTLM SSP-based servers must be configured to require NTLMv2 session security and 128-bit encryption.<VulnDiscussion>Microsoft has implemented a variety of security support providers for use with Remote Procedure Call (RPC) sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Minimum session security for NTLM SSP based (including secure RPC) servers" to "Require NTLMv2 session security" and "Require 128-bit encryption" (all options selected).If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ + +Value Name: NTLMMinServerSec + +Value Type: REG_DWORD +Value: 0x20080000 (537395200)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-SO-000370Windows Server 2019 default permissions of global system objects must be strengthened.<VulnDiscussion>Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default Discretionary Access Control List (DACL) that specifies who can access the objects with what permissions. When this policy is enabled, the default DACL is stronger, allowing non-administrative users to read shared objects but not to modify shared objects they did not create.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System objects: Strengthen default permissions of internal system objects (e.g., Symbolic Links)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\ + +Value Name: ProtectionMode + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-UC-000010Windows Server 2019 must preserve zone information when saving attachments.<VulnDiscussion>Attachments from outside sources may contain malicious code. Preserving zone of origin (Internet, intranet, local, restricted) information on file attachments allows Windows to determine risk.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366The default behavior is for Windows to mark file attachments with their zone information. + +If this needs to be corrected, configure the policy value for User Configuration >> Administrative Templates >> Windows Components >> Attachment Manager >> "Do not preserve zone information in file attachments" to "Not Configured" or "Disabled".The default behavior is for Windows to mark file attachments with their zone information. + +If the registry Value Name below does not exist, this is not a finding. + +If it exists and is configured with a value of "2", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\ + +Value Name: SaveZoneInformation + +Value Type: REG_DWORD +Value: 0x00000002 (2) (or if the Value Name does not exist)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000010Windows Server 2019 Exploit Protection system-level mitigation, Data Execution Prevention (DEP), must be on.<VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Data Execution Prevention (DEP)", are enabled by default at the system level. DEP prevents code from being run from data-only memory pages. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure Exploit Protection system-level mitigation, "Data Execution Prevention (DEP)", is turned on. The default configuration in Exploit Protection is "On by default" which meets this requirement. + +Open "Windows Defender Security Center". + +Select "App & browser control". + +Select "Exploit protection settings". + +Under "System settings", configure "Data Execution Prevention (DEP)" to "On by default" or "Use default (<On>)". + +The STIG package includes a DoD EP XML file in the "Supporting Files" folder for configuring application mitigations defined in the STIG. This can also be modified to explicitly enforce the system level requirements. Adding the following to the XML file will explicitly turn DEP on (other system level EP requirements can be combined under <SystemConfig>): + +<SystemConfig> + <DEP Enable="true"></DEP> +</SystemConfig> + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "DEP: Enable" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000030Windows Server 2019 Exploit Protection system-level mitigation, Control flow guard (CFG), must be on.<VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Control flow guard (CFG)", are enabled by default at the system level. CFG ensures flow integrity for indirect calls. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure Exploit Protection system-level mitigation, "Control flow guard (CFG)", is turned on. The default configuration in Exploit Protection is "On by default" which meets this requirement. + +Open "Windows Defender Security Center". + +Select "App & browser control". + +Select "Exploit protection settings". + +Under "System settings", configure "Control flow guard (CFG)" to "On by default" or "Use default (<On>)". + +The STIG package includes a DoD EP XML file in the "Supporting Files" folder for configuring application mitigations defined in the STIG. This can also be modified to explicitly enforce the system level requirements. Adding the following to the XML file will explicitly turn CFG on (other system level EP requirements can be combined under <SystemConfig>): + +<SystemConfig> + <ControlFlowGuard Enable="true"></ControlFlowGuard> +</SystemConfig> + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "CFG: Enable" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000040Windows Server 2019 Exploit Protection system-level mitigation, Validate exception chains (SEHOP), must be on.<VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Validate exception chains (SEHOP)", are enabled by default at the system level. SEHOP (structured exception handling overwrite protection) ensures the integrity of an exception chain during exception dispatch. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure Exploit Protection system-level mitigation, "Validate exception chains (SEHOP)", is turned on. The default configuration in Exploit Protection is "On by default" which meets this requirement. + +Open "Windows Defender Security Center". + +Select "App & browser control". + +Select "Exploit protection settings". + +Under "System settings", configure "Validate exception chains (SEHOP)" to "On by default" or "Use default (<On>)". + +The STIG package includes a DoD EP XML file in the "Supporting Files" folder for configuring application mitigations defined in the STIG. This can also be modified to explicitly enforce the system level requirements. Adding the following to the XML file will explicitly turn SEHOP on (other system level EP requirements can be combined under <SystemConfig>): + +<SystemConfig> + <SEHOP Enable="true"></SEHOP> +</SystemConfig> + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "SEHOP: Enable" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000050Windows Server 2019 Exploit Protection system-level mitigation, Validate heap integrity, must be on.<VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Validate heap integrity", are enabled by default at the system level. "Validate heap integrity" terminates a process when heap corruption is detected. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure Exploit Protection system-level mitigation, "Validate heap integrity" is turned on. The default configuration in Exploit Protection is "On by default" which meets this requirement. + +Open "Windows Defender Security Center". + +Select "App & browser control". + +Select "Exploit protection settings". + +Under "System settings", configure "Validate heap integrity" to "On by default" or "Use default (<On>)". + +The STIG package includes a DoD EP XML file in the "Supporting Files" folder for configuring application mitigations defined in the STIG. This can also be modified to explicitly enforce the system level requirements. Adding the following to the XML file will explicitly turn Validate heap integrity on (other system level EP requirements can be combined under <SystemConfig>): + +<SystemConfig> + <Heap TerminateOnError="true"></Heap> +</SystemConfig> + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "Heap: TerminateOnError" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration)SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000060Windows Server 2019 Exploit Protection mitigations must be configured for Acrobat.exe.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for Acrobat.exe: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name Acrobat.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000070Windows Server 2019 Exploit Protection mitigations must be configured for AcroRd32.exe.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for AcroRd32.exe: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name AcroRd32.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000080Windows Server 2019 Exploit Protection mitigations must be configured for chrome.exe.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for chrome.exe: + +DEP: +Enable: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name chrome.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000090Windows Server 2019 Exploit Protection mitigations must be configured for EXCEL.EXE.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for EXCEL.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name EXCEL.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000100Windows Server 2019 Exploit Protection mitigations must be configured for firefox.exe.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for firefox.exe: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name firefox.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000110Windows Server 2019 Exploit Protection mitigations must be configured for FLTLDR.EXE.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for FLTLDR.EXE: + +DEP: +Enable: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Child Process: +DisallowChildProcessCreation: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name FLTLDR.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Child Process: +DisallowChildProcessCreation: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000120Windows Server 2019 Exploit Protection mitigations must be configured for GROOVE.EXE.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for GROOVE.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Child Process: +DisallowChildProcessCreation: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name GROOVE.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Child Process: +DisallowChildProcessCreation: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000130Windows Server 2019 Exploit Protection mitigations must be configured for iexplore.exe.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for iexplore.exe: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name iexplore.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000140Windows Server 2019 Exploit Protection mitigations must be configured for INFOPATH.EXE.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for INFOPATH.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name INFOPATH.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000150Windows Server 2019 Exploit Protection mitigations must be configured for java.exe, javaw.exe, and javaws.exe.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for java.exe, javaw.exe, and javaws.exe: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name [application name]" with each of the following substituted for [application name]: +java.exe, javaw.exe, and javaws.exe +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON" for each, this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000160Windows Server 2019 Exploit Protection mitigations must be configured for lync.exe.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for lync.exe: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name lync.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000170Windows Server 2019 Exploit Protection mitigations must be configured for MSACCESS.EXE.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for MSACCESS.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name MSACCESS.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000180Windows Server 2019 Exploit Protection mitigations must be configured for MSPUB.EXE.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for MSPUB.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name MSPUB.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000190Windows Server 2019 Exploit Protection mitigations must be configured for OIS.EXE.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for OIS.EXE: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name OIS.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000200Windows Server 2019 Exploit Protection mitigations must be configured for OneDrive.exe.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for OneDrive.exe: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name OneDrive.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000210Windows Server 2019 Exploit Protection mitigations must be configured for OUTLOOK.EXE.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for OUTLOOK.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name OUTLOOK.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000220Windows Server 2019 Exploit Protection mitigations must be configured for plugin-container.exe.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for plugin-container.exe: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name plugin-container.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000230Windows Server 2019 Exploit Protection mitigations must be configured for POWERPNT.EXE.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for POWERPNT.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name POWERPNT.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000240Windows Server 2019 Exploit Protection mitigations must be configured for PPTVIEW.EXE.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for PPTVIEW.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name PPTVIEW.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000250Windows Server 2019 Exploit Protection mitigations must be configured for VISIO.EXE.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for VISIO.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name VISIO.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000260Windows Server 2019 Exploit Protection mitigations must be configured for VPREVIEW.EXE.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for VPREVIEW.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name VPREVIEW.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000270Windows Server 2019 Exploit Protection mitigations must be configured for WINWORD.EXE.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for WINWORD.EXE: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name WINWORD.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000280Windows Server 2019 Exploit Protection mitigations must be configured for wmplayer.exe.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for wmplayer.exe: + +DEP: +Enable: ON + +Payload: +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name wmplayer.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +Payload: +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-EP-000290Windows Server 2019 Exploit Protection mitigations must be configured for wordpad.exe.<VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure the following mitigations are turned "ON" for wordpad.exe: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Application mitigations defined in the STIG are configured by a DoD EP XML file included with the STIG package in the "Supporting Files" folder. + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name wordpad.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>WN19-00-000010Windows Server 2019 users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks.<VulnDiscussion>Using a privileged account to perform routine functions makes the computer vulnerable to malicious software inadvertently introduced during a session that has been granted full privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366Ensure each user with administrative privileges has a separate account for user duties and one for privileged duties.Verify each user with administrative privileges has been assigned a unique administrative account separate from their standard user account. + +If users with administrative privileges do not have separate accounts for administrative functions and standard user functions, this is a finding.SRG-OS-000368-GPOS-00154<GroupDescription></GroupDescription>WN19-CC-000210Windows Server 2019 Autoplay must be turned off for non-volume devices.<VulnDiscussion>Allowing AutoPlay to execute may introduce malicious code to a system. AutoPlay begins reading from a drive as soon as media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. This setting will disable AutoPlay for non-volume devices, such as Media Transfer Protocol (MTP) devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001764Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Disallow Autoplay for non-volume devices" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ + +Value Name: NoAutoplayfornonVolume + +Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000368-GPOS-00154<GroupDescription></GroupDescription>WN19-CC-000220Windows Server 2019 default AutoRun behavior must be configured to prevent AutoRun commands.<VulnDiscussion>Allowing AutoRun commands to execute may introduce malicious code to a system. Configuring this setting prevents AutoRun commands from executing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001764Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Set the default behavior for AutoRun" to "Enabled" with "Do not execute any autorun commands" selected.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ + +Value Name: NoAutorun + +Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000368-GPOS-00154<GroupDescription></GroupDescription>WN19-CC-000230Windows Server 2019 AutoPlay must be disabled for all drives.<VulnDiscussion>Allowing AutoPlay to execute may introduce malicious code to a system. AutoPlay begins reading from a drive as soon media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. By default, AutoPlay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive) and on network drives. Enabling this policy disables AutoPlay on all drives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001764Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> AutoPlay Policies >> "Turn off AutoPlay" to "Enabled" with "All Drives" selected.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ + +Value Name: NoDriveTypeAutoRun + +Type: REG_DWORD +Value: 0x000000ff (255)SRG-OS-000370-GPOS-00155<GroupDescription></GroupDescription>WN19-00-000080Windows Server 2019 must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.<VulnDiscussion>Using a whitelist provides a configuration management method to allow the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. + +The organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001774Configure an application whitelisting program to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. + +Configuration of whitelisting applications will vary by the program. AppLocker is a whitelisting application built into Windows Server. + +If AppLocker is used, it is configured through group policy in Computer Configuration >> Windows Settings >> Security Settings >> Application Control Policies >> AppLocker. + +Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link: + +https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfmThis is applicable to unclassified systems. For other systems, this is NA. + +Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. + +If an application whitelisting program is not in use on the system, this is a finding. + +Configuration of whitelisting applications will vary by the program. + +AppLocker is a whitelisting application built into Windows Server. A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules. + +If AppLocker is used, perform the following to view the configuration of AppLocker: + +Open "PowerShell". + +If the AppLocker PowerShell module has not been imported previously, execute the following first: + +Import-Module AppLocker + +Execute the following command, substituting [c:\temp\file.xml] with a location and file name appropriate for the system: + +Get-AppLockerPolicy -Effective -XML > c:\temp\file.xml + +This will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review. + +Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link: + +https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfmSRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-00-000270Windows Server 2019 must have the roles and features required by the system documented.<VulnDiscussion>Unnecessary roles and features increase the attack surface of a system. Limiting roles and features of a system to only those necessary reduces this potential. The standard installation option (previously called Server Core) further reduces this when selected at installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Document the roles and features required for the system to operate. Uninstall any that are not required.Required roles and features will vary based on the function of the individual system. + +Roles and features specifically required to be disabled per the STIG are identified in separate requirements. + +If the organization has not documented the roles and features required for the system(s), this is a finding. + +The PowerShell command "Get-WindowsFeature" will list all roles and features with an "Install State".SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-00-000320Windows Server 2019 must not have the Fax Server role installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Uninstall the "Fax Server" role. + +Start "Server Manager". + +Select the server with the role. + +Scroll down to "ROLES AND FEATURES" in the right pane. + +Select "Remove Roles and Features" from the drop-down "TASKS" list. + +Select the appropriate server on the "Server Selection" page and click "Next". + +Deselect "Fax Server" on the "Roles" page. + +Click "Next" and "Remove" as prompted.Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq Fax". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-00-000340Windows Server 2019 must not have the Peer Name Resolution Protocol installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Uninstall the "Peer Name Resolution Protocol" feature. + +Start "Server Manager". + +Select the server with the feature. + +Scroll down to "ROLES AND FEATURES" in the right pane. + +Select "Remove Roles and Features" from the drop-down "TASKS" list. + +Select the appropriate server on the "Server Selection" page and click "Next". + +Deselect "Peer Name Resolution Protocol" on the "Features" page. + +Click "Next" and "Remove" as prompted.Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq PNRP". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-00-000350Windows Server 2019 must not have Simple TCP/IP Services installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Uninstall the "Simple TCP/IP Services" feature. + +Start "Server Manager". + +Select the server with the feature. + +Scroll down to "ROLES AND FEATURES" in the right pane. + +Select "Remove Roles and Features" from the drop-down "TASKS" list. + +Select the appropriate server on the "Server Selection" page and click "Next". + +Deselect "Simple TCP/IP Services" on the "Features" page. + +Click "Next" and "Remove" as prompted.Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq Simple-TCPIP". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-00-000370Windows Server 2019 must not have the TFTP Client installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Uninstall the "TFTP Client" feature. + +Start "Server Manager". + +Select the server with the feature. + +Scroll down to "ROLES AND FEATURES" in the right pane. + +Select "Remove Roles and Features" from the drop-down "TASKS" list. + +Select the appropriate server on the "Server Selection" page and click "Next". + +Deselect "TFTP Client" on the "Features" page. + +Click "Next" and "Remove" as prompted.Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq TFTP-Client". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-00-000380Windows Server 2019 must not the Server Message Block (SMB) v1 protocol installed.<VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks and is not FIPS compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Uninstall the SMBv1 protocol. + +Open "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Uninstall-WindowsFeature -Name FS-SMB1 -Restart". +(Omit the Restart parameter if an immediate restart of the system cannot be done.) + +Alternately: + +Start "Server Manager". + +Select the server with the feature. + +Scroll down to "ROLES AND FEATURES" in the right pane. + +Select "Remove Roles and Features" from the drop-down "TASKS" list. + +Select the appropriate server on the "Server Selection" page and click "Next". + +Deselect "SMB 1.0/CIFS File Sharing Support" on the "Features" page. + +Click "Next" and "Remove" as prompted.Different methods are available to disable SMBv1 on Windows Server 2019. This is the preferred method, however if WN19-00-000390 and WN19-00-000400 are configured, this is NA. + +Open "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-WindowsFeature -Name FS-SMB1". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-00-000390Windows Server 2019 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server.<VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 Server" to "Disabled". + +The system must be restarted for the change to take effect. + +This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.Different methods are available to disable SMBv1 on Windows Server 2019, if WN19-00-000380 is configured, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\ + +Value Name: SMB1 + +Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-00-000400Windows Server 2019 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client.<VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 client driver" to "Enabled" with "Disable driver (recommended)" selected for "Configure MrxSmb10 driver". + +The system must be restarted for the changes to take effect. + +This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.Different methods are available to disable SMBv1 on Windows Server 2019, if WN19-00-000380 is configured, this is NA. + +If the following registry value is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\ + +Value Name: Start + +Type: REG_DWORD +Value: 0x00000004 (4)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-00-000410Windows Server 2019 must not have Windows PowerShell 2.0 installed.<VulnDiscussion>Windows PowerShell 5.x added advanced logging features that can provide additional detail when malware has been run on a system. Disabling the Windows PowerShell 2.0 mitigates against a downgrade attack that evades the Windows PowerShell 5.x script block logging feature.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Uninstall the "Windows PowerShell 2.0 Engine". + +Start "Server Manager". + +Select the server with the feature. + +Scroll down to "ROLES AND FEATURES" in the right pane. + +Select "Remove Roles and Features" from the drop-down "TASKS" list. + +Select the appropriate server on the "Server Selection" page and click "Next". + +Deselect "Windows PowerShell 2.0 Engine" under "Windows PowerShell" on the "Features" page. + +Click "Next" and "Remove" as prompted.Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq PowerShell-v2". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-CC-000010Windows Server 2019 must prevent the display of slide shows on the lock screen.<VulnDiscussion>Slide shows that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged-on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Control Panel >> Personalization >> "Prevent enabling lock screen slide show" to "Enabled".Verify the registry value below. + +If it does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Personalization\ + +Value Name: NoLockScreenSlideshow + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-CC-000020Windows Server 2019 must have WDigest Authentication disabled.<VulnDiscussion>When the WDigest Authentication protocol is enabled, plain-text passwords are stored in the Local Security Authority Subsystem Service (LSASS), exposing them to theft. WDigest is disabled by default in Windows Server 2019. This setting ensures this is enforced.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "WDigest Authentication (disabling may require KB2871997)" to "Disabled". + +This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and " SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest\ + +Value Name: UseLogonCredential + +Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-CC-000150Windows Server 2019 downloading print driver packages over HTTP must be turned off.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and will prevent uncontrolled updates to the system. + +This setting prevents the computer from downloading print driver packages over HTTP.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> "Turn off downloading of print drivers over HTTP" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\ + +Value Name: DisableWebPnPDownload + +Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-CC-000160Windows Server 2019 printing over HTTP must be turned off.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and will prevent uncontrolled updates to the system. + +This setting prevents the client computer from printing over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Internet Communication Management >> Internet Communication settings >> "Turn off printing over HTTP" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\ + +Value Name: DisableHTTPPrinting + +Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-CC-000170Windows Server 2019 network selection user interface (UI) must not be displayed on the logon screen.<VulnDiscussion>Enabling interaction with the network selection UI allows users to change connections to available networks without signing in to Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> "Do not display network selection UI" to "Enabled".Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ + +Value Name: DontDisplayNetworkSelectionUI + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-CC-000200Windows Server 2019 Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.<VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and will prevent uncontrolled updates to the system. + +This setting will prevent the Program Inventory from collecting data about a system and sending the information to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Application Compatibility >> "Turn off Inventory Collector" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppCompat\ + +Value Name: DisableInventory + +Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-CC-000300Windows Server 2019 Windows Defender SmartScreen must be enabled.<VulnDiscussion>Windows Defender SmartScreen helps protect systems from programs downloaded from the internet that may be malicious. Enabling SmartScreen can block potentially malicious programs or warn users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Configure Windows Defender SmartScreen" to "Enabled" with either option "Warn" or "Warn and prevent bypass" selected. + +Windows 2019 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Explorer.This is applicable to unclassified systems; for other systems, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ + +Value Name: EnableSmartScreen + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-CC-000400Windows Server 2019 must disable Basic authentication for RSS feeds over HTTP.<VulnDiscussion>Basic authentication uses plain-text passwords that could be used to compromise a system. Disabling Basic authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections. + +If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> RSS Feeds >> "Turn on Basic feed authentication over HTTP" to "Not Configured" or "Disabled".The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections. + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds\ + +Value Name: AllowBasicAuthInClear + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-CC-000410Windows Server 2019 must prevent Indexing of encrypted files.<VulnDiscussion>Indexing of encrypted files may expose sensitive data. This setting prevents encrypted files from being indexed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Search >> "Allow indexing of encrypted files" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Windows Search\ + +Value Name: AllowIndexingEncryptedStoresOrItems + +Value Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-DC-000130Windows Server 2019 domain controllers must run on a machine dedicated to that function.<VulnDiscussion>Executing application servers on the same host machine with a directory server may substantially weaken the security of the directory server. Web or database server applications usually require the addition of many programs and accounts, increasing the attack surface of the computer. + +Some applications require the addition of privileged accounts, providing potential sources of compromise. Some applications (such as Microsoft Exchange) may require the use of network ports or services conflicting with the directory server. In this case, non-standard ports might be selected, and this could interfere with intrusion detection or prevention services.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Remove additional roles or applications such as web, database, and email from the domain controller.This applies to domain controllers, it is NA for other systems. + +Review the installed roles the domain controller is supporting. + +Start "Server Manager". + +Select "AD DS" in the left pane and the server name under "Servers" to the right. + +Select "Add (or Remove) Roles and Features" from "Tasks" in the "Roles and Features" section. (Cancel before any changes are made.) + +Determine if any additional server roles are installed. A basic domain controller setup will include the following: + +- Active Directory Domain Services +- DNS Server +- File and Storage Services + +If any roles not requiring installation on a domain controller are installed, this is a finding. + +A Domain Name System (DNS) server integrated with the directory server (e.g., AD-integrated DNS) is an acceptable application. However, the DNS server must comply with the DNS STIG security requirements. + +Run "Programs and Features". + +Review installed applications. + +If any applications are installed that are not required for the domain controller, this is a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>WN19-MS-000030Windows Server 2019 local users on domain-joined member servers must not be enumerated.<VulnDiscussion>The username is one part of logon credentials that could be used to gain access to a system. Preventing the enumeration of users limits this information to authorized personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000381Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Logon >> "Enumerate local users on domain-joined computers" to "Disabled".This applies to member servers. For domain controllers and standalone systems, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ + +Value Name: EnumerateLocalUsers + +Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000096-GPOS-00050<GroupDescription></GroupDescription>WN19-00-000330Windows Server 2019 must not have the Microsoft FTP service installed unless required by the organization.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000382Uninstall the "FTP Server" role. + +Start "Server Manager". + +Select the server with the role. + +Scroll down to "ROLES AND FEATURES" in the right pane. + +Select "Remove Roles and Features" from the drop-down "TASKS" list. + +Select the appropriate server on the "Server Selection" page and click "Next". + +Deselect "FTP Server" under "Web Server (IIS)" on the "Roles" page. + +Click "Next" and "Remove" as prompted.If the server has the role of an FTP server, this is NA. + +Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq Web-Ftp-Service". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + +If the system has the role of an FTP server, this must be documented with the ISSO.SRG-OS-000096-GPOS-00050<GroupDescription></GroupDescription>WN19-00-000360Windows Server 2019 must not have the Telnet Client installed.<VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000382Uninstall the "Telnet Client" feature. + +Start "Server Manager". + +Select the server with the feature. + +Scroll down to "ROLES AND FEATURES" in the right pane. + +Select "Remove Roles and Features" from the drop-down "TASKS" list. + +Select the appropriate server on the "Server Selection" page and click "Next". + +Deselect "Telnet Client" on the "Features" page. + +Click "Next" and "Remove" as prompted.Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq Telnet-Client". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding.SRG-OS-000373-GPOS-00157<GroupDescription></GroupDescription>WN19-CC-000340Windows Server 2019 must not save passwords in the Remote Desktop Client.<VulnDiscussion>Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system. The system must be configured to prevent users from saving passwords in the Remote Desktop Client. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002038Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Connection Client >> "Do not allow passwords to be saved" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: DisablePasswordSaving + +Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000373-GPOS-00157<GroupDescription></GroupDescription>WN19-CC-000360Windows Server 2019 Remote Desktop Services must always prompt a client for passwords upon connection.<VulnDiscussion>This setting controls the ability of users to supply passwords automatically as part of their remote desktop connection. Disabling this setting would allow anyone to use the stored credentials in a connection item to connect to the terminal server. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002038Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> "Always prompt for password upon connection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fPromptForPassword + +Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000373-GPOS-00157<GroupDescription></GroupDescription>WN19-CC-000520Windows Server 2019 Windows Remote Management (WinRM) service must not store RunAs credentials.<VulnDiscussion>Storage of administrative credentials could allow unauthorized access. Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002038Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Disallow WinRM from storing RunAs credentials" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ + +Value Name: DisableRunAs + +Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000373-GPOS-00157<GroupDescription></GroupDescription>WN19-SO-000380Windows Server 2019 User Account Control approval mode for the built-in Administrator must be enabled.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the built-in Administrator account so that it runs in Admin Approval Mode. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002038Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Admin Approval Mode for the Built-in Administrator account" to "Enabled".UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: FilterAdministratorToken + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000373-GPOS-00157<GroupDescription></GroupDescription>WN19-SO-000410Windows Server 2019 User Account Control must automatically deny standard user requests for elevation.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting controls the behavior of elevation when requested by a standard user account. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002038Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests".UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: ConsentPromptBehaviorUser + +Value Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000373-GPOS-00157<GroupDescription></GroupDescription>WN19-SO-000440Windows Server 2019 User Account Control must run all administrators in Admin Approval Mode, enabling UAC.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting enables UAC. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002038Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Run all administrators in Admin Approval Mode" to "Enabled".UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableLUA + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000104-GPOS-00051<GroupDescription></GroupDescription>WN19-00-000070Windows Server 2019 shared user accounts must not be permitted.<VulnDiscussion>Shared accounts (accounts where two or more people log on with the same user identification) do not provide adequate identification and authentication. There is no way to provide for nonrepudiation or individual accountability for system access and resource usage.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000764Remove unapproved shared accounts from the system. + +Document required shared accounts with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity.Determine whether any shared accounts exist. If no shared accounts exist, this is NA. + +Shared accounts, such as required by an application, may be approved by the organization. This must be documented with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity. + +If unapproved shared accounts exist, this is a finding.SRG-OS-000104-GPOS-00051<GroupDescription></GroupDescription>WN19-00-000200Windows Server 2019 accounts must require passwords.<VulnDiscussion>The lack of password protection enables anyone to gain access to the information system, which opens a backdoor opportunity for intruders to compromise the system as well as other resources. Accounts on a system must require passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000764Configure all enabled accounts to require passwords. + +The password required flag can be set by entering the following on a command line: "Net user [username] /passwordreq:yes", substituting [username] with the name of the user account.Review the password required status for enabled user accounts. + +Open "PowerShell". + +Domain Controllers: + +Enter "Get-Aduser -Filter * -Properties Passwordnotrequired |FT Name, Passwordnotrequired, Enabled". + +Exclude disabled accounts (e.g., DefaultAccount, Guest) and Trusted Domain Objects (TDOs). + +If "Passwordnotrequired" is "True" or blank for any enabled user account, this is a finding. + +Member servers and standalone systems: + +Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordRequired=False and LocalAccount=True" | FT Name, PasswordRequired, Disabled, LocalAccount'. + +Exclude disabled accounts (e.g., DefaultAccount, Guest). + +If any enabled user accounts are returned with a "PasswordRequired" status of "False", this is a finding.SRG-OS-000105-GPOS-00052<GroupDescription></GroupDescription>WN19-DC-000310Windows Server 2019 Active Directory user accounts, including administrators, must be configured to require the use of a Common Access Card (CAC), Personal Identity Verification (PIV)-compliant hardware token, or Alternate Logon Token (ALT) for user authentication.<VulnDiscussion>Smart cards such as the CAC support a two-factor authentication technique. This provides a higher level of trust in the asserted identity than use of the username and password for authentication. + +Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055, SRG-OS-000375-GPOS-00160</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000765CCI-000766CCI-000767CCI-000768CCI-001948Configure all user accounts, including administrator accounts, in Active Directory to enable the option "Smart card is required for interactive logon". + +Run "Active Directory Users and Computers" (available from various menus or run "dsa.msc"): + +Select the OU where the user accounts are located. (By default this is the Users node; however, accounts may be under other organization-defined OUs.) + +Right-click the user account and select "Properties". + +Select the "Account" tab. + +Check "Smart card is required for interactive logon" in the "Account Options" area.This applies to domain controllers. It is NA for other systems. + +Open "PowerShell". + +Enter the following: + +"Get-ADUser -Filter {(Enabled -eq $True) -and (SmartcardLogonRequired -eq $False)} | FT Name" +("DistinguishedName" may be substituted for "Name" for more detailed output.) + +If any user accounts, including administrators, are listed, this is a finding. + + +Alternately: + +To view sample accounts in "Active Directory Users and Computers" (available from various menus or run "dsa.msc"): + +Select the Organizational Unit (OU) where the user accounts are located. (By default, this is the Users node; however, accounts may be under other organization-defined OUs.) + +Right-click the sample user account and select "Properties". + +Select the "Account" tab. + +If any user accounts, including administrators, do not have "Smart card is required for interactive logon" checked in the "Account Options" area, this is a finding.SRG-OS-000112-GPOS-00057<GroupDescription></GroupDescription>WN19-DC-000020Windows Server 2019 Kerberos user logon restrictions must be enforced.<VulnDiscussion>This policy setting determines whether the Kerberos Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the target computer. The policy is enabled by default, which is the most secure setting for validating that access to target resources is not circumvented. + +Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001941CCI-001942Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Enforce user logon restrictions" to "Enabled".This applies to domain controllers. It is NA for other systems. + +Verify the following is configured in the Default Domain Policy: + +Open "Group Policy Management". + +Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). + +Right-click on the "Default Domain Policy". + +Select "Edit". + +Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. + +If the "Enforce user logon restrictions" is not set to "Enabled", this is a finding.SRG-OS-000112-GPOS-00057<GroupDescription></GroupDescription>WN19-DC-000030Windows Server 2019 Kerberos service ticket maximum lifetime must be limited to 600 minutes or less.<VulnDiscussion>This setting determines the maximum amount of time (in minutes) that a granted session ticket can be used to access a particular service. Session tickets are used only to authenticate new connections with servers. Ongoing operations are not interrupted if the session ticket used to authenticate the connection expires during the connection. + +Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001941CCI-001942Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Maximum lifetime for service ticket" to a maximum of "600" minutes, but not "0", which equates to "Ticket doesn't expire".This applies to domain controllers. It is NA for other systems. + +Verify the following is configured in the Default Domain Policy: + +Open "Group Policy Management". + +Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). + +Right-click on the "Default Domain Policy". + +Select "Edit". + +Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. + +If the value for "Maximum lifetime for service ticket" is "0" or greater than "600" minutes, this is a finding.SRG-OS-000112-GPOS-00057<GroupDescription></GroupDescription>WN19-DC-000040Windows Server 2019 Kerberos user ticket lifetime must be limited to 10 hours or less.<VulnDiscussion>In Kerberos, there are two types of tickets: Ticket Granting Tickets (TGTs) and Service Tickets. Kerberos tickets have a limited lifetime so the time an attacker has to implement an attack is limited. This policy controls how long TGTs can be renewed. With Kerberos, the user's initial authentication to the domain controller results in a TGT, which is then used to request Service Tickets to resources. Upon startup, each computer gets a TGT before requesting a service ticket to the domain controller and any other computers it needs to access. For services that start up under a specified user account, users must always get a TGT first and then get Service Tickets to all computers and services accessed. + +Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001941CCI-001942Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Maximum lifetime for user ticket" to a maximum of "10" hours but not "0", which equates to "Ticket doesn't expire".This applies to domain controllers. It is NA for other systems. + +Verify the following is configured in the Default Domain Policy: + +Open "Group Policy Management". + +Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). + +Right-click on the "Default Domain Policy". + +Select "Edit". + +Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. + +If the value for "Maximum lifetime for user ticket" is "0" or greater than "10" hours, this is a finding.SRG-OS-000112-GPOS-00057<GroupDescription></GroupDescription>WN19-DC-000050Windows Server 2019 Kerberos policy user ticket renewal maximum lifetime must be limited to seven days or less.<VulnDiscussion>This setting determines the period of time (in days) during which a user's Ticket Granting Ticket (TGT) may be renewed. This security configuration limits the amount of time an attacker has to crack the TGT and gain access. + +Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001941CCI-001942Configure the policy value in the Default Domain Policy for Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Maximum lifetime for user ticket renewal" to a maximum of "7" days or less.This applies to domain controllers. It is NA for other systems. + +Verify the following is configured in the Default Domain Policy: + +Open "Group Policy Management". + +Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). + +Right-click on the "Default Domain Policy". + +Select "Edit". + +Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. + +If the "Maximum lifetime for user ticket renewal" is greater than "7" days, this is a finding.SRG-OS-000112-GPOS-00057<GroupDescription></GroupDescription>WN19-DC-000060Windows Server 2019 computer clock synchronization tolerance must be limited to five minutes or less.<VulnDiscussion>This setting determines the maximum time difference (in minutes) that Kerberos will tolerate between the time on a client's clock and the time on a server's clock while still considering the two clocks synchronous. In order to prevent replay attacks, Kerberos uses timestamps as part of its protocol definition. For timestamps to work properly, the clocks of the client and the server need to be in sync as much as possible. + +Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001941CCI-001942Configure the policy value in the Default Domain Policy for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy >> "Maximum tolerance for computer clock synchronization" to a maximum of "5" minutes or less.This applies to domain controllers. It is NA for other systems. + +Verify the following is configured in the Default Domain Policy: + +Open "Group Policy Management". + +Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). + +Right-click on the "Default Domain Policy". + +Select "Edit". + +Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. + +If the "Maximum tolerance for computer clock synchronization" is greater than "5" minutes, this is a finding.SRG-OS-000379-GPOS-00164<GroupDescription></GroupDescription>WN19-MS-000040Windows Server 2019 must restrict unauthenticated Remote Procedure Call (RPC) clients from connecting to the RPC server on domain-joined member servers and standalone systems.<VulnDiscussion>Unauthenticated RPC clients may allow anonymous access to sensitive information. Configuring RPC to restrict unauthenticated RPC clients from connecting to the RPC server will prevent anonymous connections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001967Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Remote Procedure Call >> "Restrict Unauthenticated RPC clients" to "Enabled" with "Authenticated" selected.This applies to member servers and standalone systems, it is NA for domain controllers. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Rpc\ + +Value Name: RestrictRemoteClients + +Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000379-GPOS-00164<GroupDescription></GroupDescription>WN19-SO-000090Windows Server 2019 computer account password must not be prevented from being reset.<VulnDiscussion>Computer account passwords are changed automatically on a regular basis. Disabling automatic password changes can make the system more vulnerable to malicious access. Frequent password changes can be a significant safeguard for the system. A new password for the computer account will be generated every 30 days.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001967Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Disable machine account password changes" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: DisablePasswordChange + +Value Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000118-GPOS-00060<GroupDescription></GroupDescription>WN19-00-000190Windows Server 2019 outdated or unused accounts must be removed or disabled.<VulnDiscussion>Outdated or unused accounts provide penetration points that may go undetected. Inactive accounts must be deleted if no longer necessary or, if still required, disabled until needed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000795Regularly review accounts to determine if they are still active. Remove or disable accounts that have not been used in the last 35 days.Open "Windows PowerShell". + +Domain Controllers: + +Enter "Search-ADAccount -AccountInactive -UsersOnly -TimeSpan 35.00:00:00" + +This will return accounts that have not been logged on to for 35 days, along with various attributes such as the Enabled status and LastLogonDate. + +Member servers and standalone systems: + +Copy or enter the lines below to the PowerShell window and enter. (Entering twice may be required. Do not include the quotes at the beginning and end of the query.) + +"([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach { + $user = ([ADSI]$_.Path) + $lastLogin = $user.Properties.LastLogin.Value + $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2 + if ($lastLogin -eq $null) { + $lastLogin = 'Never' + } + Write-Host $user.Name $lastLogin $enabled +}" + +This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False). +For example: User1 10/31/2015 5:49:56 AM True + +Review the list of accounts returned by the above queries to determine the finding validity for each account reported. + +Exclude the following accounts: + +- Built-in administrator account (Renamed, SID ending in 500) +- Built-in guest account (Renamed, Disabled, SID ending in 501) +- Application accounts + +If any enabled accounts have not been logged on to within the past 35 days, this is a finding. + +Inactive accounts that have been reviewed and deemed to be required must be documented with the ISSO.SRG-OS-000069-GPOS-00037<GroupDescription></GroupDescription>WN19-AC-000080Windows Server 2019 must have the built-in Windows password complexity policy enabled.<VulnDiscussion>The use of complex passwords increases their strength against attack. The built-in Windows password complexity policy requires passwords to contain at least three of the four types of characters (numbers, uppercase and lowercase letters, and special characters) and prevents the inclusion of user names or parts of user names. + +Satisfies: SRG-OS-000069-GPOS-00037, SRG-OS-000070-GPOS-00038, SRG-OS-000071-GPOS-00039, SRG-OS-000266-GPOS-00101</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000192CCI-000193CCI-000194CCI-001619Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Password must meet complexity requirements" to "Enabled".Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for "Password must meet complexity requirements" is not set to "Enabled", this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt + +If "PasswordComplexity" equals "0" in the file, this is a finding. + +Note: If an external password filter is in use that enforces all four character types and requires this setting to be set to "Disabled", this would not be considered a finding. If this setting does not affect the use of an external password filter, it must be enabled for fallback purposes.SRG-OS-000078-GPOS-00046<GroupDescription></GroupDescription>WN19-00-000050Windows Server 2019 manually managed application account passwords must be at least 15 characters in length.<VulnDiscussion>Application/service account passwords must be of sufficient length to prevent being easily cracked. Application/service accounts that are manually managed must have passwords at least 15 characters in length.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000205Establish a policy that requires application/service account passwords that are manually managed to be at least 15 characters in length. Ensure the policy is enforced.Determine if manually managed application/service accounts exist. If none exist, this is NA. + +Verify the organization has a policy to ensure passwords for manually managed application/service accounts are at least 15 characters in length. + +If such a policy does not exist or has not been implemented, this is a finding.SRG-OS-000078-GPOS-00046<GroupDescription></GroupDescription>WN19-AC-000070Windows Server 2019 minimum password length must be configured to 14 characters.<VulnDiscussion>Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system and compromising the device, information, or the local network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000205Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Minimum password length" to "14" characters.Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for the "Minimum password length," is less than "14" characters, this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt + +If "MinimumPasswordLength" is less than "14" in the file, this is a finding.SRG-OS-000073-GPOS-00041<GroupDescription></GroupDescription>WN19-AC-000090Windows Server 2019 reversible password encryption must be disabled.<VulnDiscussion>Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords, which are easily compromised. For this reason, this policy must never be enabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000196Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Store passwords using reversible encryption" to "Disabled".Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for "Store passwords using reversible encryption" is not set to "Disabled", this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt + +If "ClearTextPassword" equals "1" in the file, this is a finding.SRG-OS-000073-GPOS-00041<GroupDescription></GroupDescription>WN19-SO-000300Windows Server 2019 must be configured to prevent the storage of the LAN Manager hash of passwords.<VulnDiscussion>The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords. This setting controls whether a LAN Manager hash of the password is stored in the SAM the next time the password is changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000196Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Do not store LAN Manager hash value on next password change" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: NoLMHash + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000074-GPOS-00042<GroupDescription></GroupDescription>WN19-SO-000180Windows Server 2019 unencrypted passwords must not be sent to third-party Server Message Block (SMB) servers.<VulnDiscussion>Some non-Microsoft SMB servers only support unencrypted (plain-text) password authentication. Sending plain-text passwords across the network when authenticating to an SMB server reduces the overall security of the environment. Check with the vendor of the SMB server to determine if there is a way to support encrypted password authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000197Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft Network Client: Send unencrypted password to third-party SMB servers" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ + +Value Name: EnablePlainTextPassword + +Value Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000075-GPOS-00043<GroupDescription></GroupDescription>WN19-AC-000060Windows Server 2019 minimum password age must be configured to at least one day.<VulnDiscussion>Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database. This enables users to effectively negate the purpose of mandating periodic password changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000198Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Minimum password age" to at least "1" day.Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for the "Minimum password age" is set to "0" days ("Password can be changed immediately"), this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt + +If "MinimumPasswordAge" equals "0" in the file, this is a finding.SRG-OS-000076-GPOS-00044<GroupDescription></GroupDescription>WN19-00-000020Windows Server 2019 passwords for the built-in Administrator account must be changed at least every 60 days.<VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. The built-in Administrator account is not generally used and its password not may be changed as frequently as necessary. Changing the password for the built-in Administrator account on a regular basis will limit its exposure. + +Organizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every "30" days by default.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000199Change the built-in Administrator account password at least every "60" days. + +Automated tools, such as Microsoft's LAPS, may be used on domain-joined member servers to accomplish this.Review the password last set date for the built-in Administrator account. + +Domain controllers: + +Open "PowerShell". + +Enter "Get-ADUser -Filter * -Properties SID, PasswordLastSet | Where SID -Like "*-500" | Ft Name, SID, PasswordLastSet". + +If the "PasswordLastSet" date is greater than "60" days old, this is a finding. + +Member servers and standalone systems: + +Open "Command Prompt". + +Enter 'Net User [account name] | Find /i "Password Last Set"', where [account name] is the name of the built-in administrator account. + +(The name of the built-in Administrator account must be changed to something other than "Administrator" per STIG requirements.) + +If the "PasswordLastSet" date is greater than "60" days old, this is a finding.SRG-OS-000076-GPOS-00044<GroupDescription></GroupDescription>WN19-00-000210Windows Server 2019 passwords must be configured to expire.<VulnDiscussion>Passwords that do not expire or are reused increase the exposure of a password with greater probability of being discovered or cracked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000199Configure all enabled user account passwords to expire. + +Uncheck "Password never expires" for all enabled user accounts in Active Directory Users and Computers for domain accounts and Users in Computer Management for member servers and standalone systems. Document any exceptions with the ISSO.Review the password never expires status for enabled user accounts. + +Open "PowerShell". + +Domain Controllers: + +Enter "Search-ADAccount -PasswordNeverExpires -UsersOnly | FT Name, PasswordNeverExpires, Enabled". + +Exclude application accounts, disabled accounts (e.g., DefaultAccount, Guest) and the krbtgt account. + +If any enabled user accounts are returned with a "PasswordNeverExpires" status of "True", this is a finding. + +Member servers and standalone systems: + +Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordExpires=False and LocalAccount=True" | FT Name, PasswordExpires, Disabled, LocalAccount'. + +Exclude application accounts and disabled accounts (e.g., DefaultAccount, Guest). + +If any enabled user accounts are returned with a "PasswordExpires" status of "False", this is a finding.SRG-OS-000076-GPOS-00044<GroupDescription></GroupDescription>WN19-AC-000050Windows Server 2019 maximum password age must be configured to 60 days or less.<VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000199Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Maximum password age" to "60" days or less (excluding "0", which is unacceptable).Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for the "Maximum password age" is greater than "60" days, this is a finding. + +If the value is set to "0" (never expires), this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt + +If "MaximumPasswordAge" is greater than "60" or equal to "0" in the file, this is a finding.SRG-OS-000077-GPOS-00045<GroupDescription></GroupDescription>WN19-AC-000040Windows Server 2019 password history must be configured to 24 passwords remembered.<VulnDiscussion>A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change to a unique password on a regularly scheduled basis. This enables users to effectively negate the purpose of mandating periodic password changes. The default value is "24" for Windows domain systems. DoD has decided this is the appropriate value for all Windows systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000200Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Enforce password history" to "24" passwords remembered.Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for "Enforce password history" is less than "24" passwords remembered, this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt + +If "PasswordHistorySize" is less than "24" in the file, this is a finding.SRG-OS-000066-GPOS-00034<GroupDescription></GroupDescription>WN19-DC-000280Windows Server 2019 domain controllers must have a PKI server certificate.<VulnDiscussion>Domain controllers are part of the chain of trust for PKI authentications. Without the appropriate certificate, the authenticity of the domain controller cannot be verified. Domain controllers must have a server certificate to establish authenticity as part of PKI authentications in the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000185Obtain a server certificate for the domain controller.This applies to domain controllers. It is NA for other systems. + +Run "MMC". + +Select "Add/Remove Snap-in" from the "File" menu. + +Select "Certificates" in the left pane and click the "Add >" button. + +Select "Computer Account" and click "Next". + +Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish". + +Click "OK". + +Select and expand the Certificates (Local Computer) entry in the left pane. + +Select and expand the Personal entry in the left pane. + +Select the Certificates entry in the left pane. + +If no certificate for the domain controller exists in the right pane, this is a finding.SRG-OS-000066-GPOS-00034<GroupDescription></GroupDescription>WN19-DC-000290Windows Server 2019 domain Controller PKI certificates must be issued by the DoD PKI or an approved External Certificate Authority (ECA).<VulnDiscussion>A PKI implementation depends on the practices established by the Certificate Authority (CA) to ensure the implementation is secure. Without proper practices, the certificates issued by a CA have limited value in authentication functions. The use of multiple CAs from separate PKI implementations results in interoperability issues. If servers and clients do not have a common set of root CA certificates, they are not able to authenticate each other.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000185Obtain a server certificate for the domain controller issued by the DoD PKI or an approved ECA.This applies to domain controllers. It is NA for other systems. + +Run "MMC". + +Select "Add/Remove Snap-in" from the "File" menu. + +Select "Certificates" in the left pane and click the "Add >" button. + +Select "Computer Account" and click "Next". + +Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish". + +Click "OK". + +Select and expand the Certificates (Local Computer) entry in the left pane. + +Select and expand the Personal entry in the left pane. + +Select the Certificates entry in the left pane. + +In the right pane, examine the "Issued By" field for the certificate to determine the issuing CA. + +If the "Issued By" field of the PKI certificate being used by the domain controller does not indicate the issuing CA is part of the DoD PKI or an approved ECA, this is a finding. + +If the certificates in use are issued by a CA authorized by the Component's CIO, this is a CAT II finding. + +There are multiple sources from which lists of valid DoD CAs and approved ECAs can be obtained: + +The Global Directory Service (GDS) website provides an online source. The address for this site is https://crl.gds.disa.mil. + +DoD Public Key Enablement (PKE) Engineering Support maintains the InstallRoot utility to manage DoD supported root certificates on Windows computers, which includes a list of authorized CAs. The utility package can be downloaded from the PKI and PKE Tools page on IASE: + +http://iase.disa.mil/pki-pke/function_pages/tools.htmlSRG-OS-000066-GPOS-00034<GroupDescription></GroupDescription>WN19-DC-000300Windows Server 2019 PKI certificates associated with user accounts must be issued by a DoD PKI or an approved External Certificate Authority (ECA).<VulnDiscussion>A PKI implementation depends on the practices established by the Certificate Authority (CA) to ensure the implementation is secure. Without proper practices, the certificates issued by a CA have limited value in authentication functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000185Map user accounts to PKI certificates using the appropriate User Principal Name (UPN) for the network. See PKE documentation for details.This applies to domain controllers. It is NA for other systems. + +Review user account mappings to PKI certificates. + +Open "Windows PowerShell". + +Enter "Get-ADUser -Filter * | FT Name, UserPrincipalName, Enabled". + +Exclude disabled accounts (e.g., DefaultAccount, Guest) and the krbtgt account. + +If the User Principal Name (UPN) is not in the format of an individual's identifier for the certificate type and for the appropriate domain suffix, this is a finding. + +For standard NIPRNet certificates, the individual's identifier is in the format of an Electronic Data Interchange - Personnel Identifier (EDI-PI). + +Alt Tokens and other certificates may use a different UPN format than the EDI-PI which vary by organization. Verified these with the organization. + +NIPRNet Example: + +Name - User Principal Name +User1 - 1234567890@mil + +See PKE documentation for other network domain suffixes. + +If the mappings are to certificates issued by a CA authorized by the Component's CIO, this is a CAT II finding.SRG-OS-000066-GPOS-00034<GroupDescription></GroupDescription>WN19-PK-000010Windows Server 2019 must have the DoD Root Certificate Authority (CA) certificates installed in the Trusted Root Store.<VulnDiscussion>To ensure secure DoD websites and DoD-signed code are properly validated, the system must trust the DoD Root CAs. The DoD root certificates will ensure that the trust chain is established for server certificates issued from the DoD CAs. + +Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000185CCI-002470Install the DoD Root CA certificates: + +DoD Root CA 2 +DoD Root CA 3 +DoD Root CA 4 +DoD Root CA 5 + +The InstallRoot tool is available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.The certificates and thumbprints referenced below apply to unclassified systems; see PKE documentation for other networks. + +Open "Windows PowerShell" as an administrator. + +Execute the following command: + +Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*DoD*" | FL Subject, Thumbprint, NotAfter + +If the following certificate "Subject" and "Thumbprint" information is not displayed, this is a finding. + +If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. + +Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561 +NotAfter: 12/5/2029 + +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB +NotAfter: 12/30/2029 + +Subject: CN=DoD Root CA 4, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026 +NotAfter: 7/25/2032 + +Subject: CN=DoD Root CA 5, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B +NotAfter: 6/14/2041 + +Alternately, use the Certificates MMC snap-in: + +Run "MMC". + +Select "File", "Add/Remove Snap-in". + +Select "Certificates" and click "Add". + +Select "Computer account" and click "Next". + +Select "Local computer: (the computer this console is running on)" and click "Finish". + +Click "OK". + +Expand "Certificates" and navigate to "Trusted Root Certification Authorities >> Certificates". + +For each of the DoD Root CA certificates noted below: + +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the DoD Root CA certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. + +DoD Root CA 2 +Thumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561 +Valid to: Wednesday, December 5, 2029 + +DoD Root CA 3 +Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB +Valid to: Sunday, December 30, 2029 + +DoD Root CA 4 +Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026 +Valid to: Sunday, July 25, 2032 + +DoD Root CA 5 +Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B +Valid to: Friday, June 14, 2041SRG-OS-000066-GPOS-00034<GroupDescription></GroupDescription>WN19-PK-000020Windows Server 2019 must have the DoD Interoperability Root Certificate Authority (CA) cross-certificates installed in the Untrusted Certificates Store on unclassified systems.<VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. + +Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000185CCI-002470Install the DoD Interoperability Root CA cross-certificates on unclassified systems. + +Issued To - Issued By - Thumbprint +DoD Root CA 2 - DoD Interoperability Root CA 1 - 22BBE981F0694D246CC1472ED2B021DC8540A22F + +DoD Root CA 3 - DoD Interoperability Root CA 2 - FFAD03329B9E527A43EEC66A56F9CBB5393E6E13 + +DoD Root CA 3 - DoD Interoperability Root CA 2 - FCE1B1E25374DD94F5935BEB86CA643D8C8D1FF4 + +Administrators should run the Federal Bridge Certification Authority (FBCA) Cross-Certificate Removal Tool once as an administrator and once as the current user. + +The FBCA Cross-Certificate Remover Tool and User Guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.This is applicable to unclassified systems. It is NA for others. + +Open "PowerShell" as an administrator. + +Execute the following command: + +Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter + +If the following certificate "Subject", "Issuer", and "Thumbprint" information is not displayed, this is a finding. + +If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. + +Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F +NotAfter: 9/6/2019 + +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: FCE1B1E25374DD94F5935BEB86CA643D8C8D1FF4 +NotAfter: 2/17/2019 + +Alternately, use the Certificates MMC snap-in: + +Run "MMC". + +Select "File", "Add/Remove Snap-in". + +Select "Certificates" and click "Add". + +Select "Computer account" and click "Next". + +Select "Local computer: (the computer this console is running on)" and click "Finish". + +Click "OK". + +Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". + +For each certificate with "DoD Root CA..." under "Issued To" and "DoD Interoperability Root CA..." under "Issued By": + +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. + +Issued To: DoD Root CA 2 +Issued By: DoD Interoperability Root CA 1 +Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F +Valid to: Friday, September 6, 2019 + +Issued To: DoD Root CA 3 +Issued By: DoD Interoperability Root CA 2 +Thumbprint: FFAD03329B9E527A43EEC66A56F9CBB5393E6E13 +Valid to: Sunday, September 23, 2018 + +Issued To: DoD Root CA 3 +Issued By: DoD Interoperability Root CA 2 +Thumbprint: FCE1B1E25374DD94F5935BEB86CA643D8C8D1FF4 +Valid to: Sunday, February 17, 2019SRG-OS-000066-GPOS-00034<GroupDescription></GroupDescription>WN19-PK-000030Windows Server 2019 must have the US DoD CCEB Interoperability Root CA cross-certificates in the Untrusted Certificates Store on unclassified systems.<VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. + +Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000185CCI-002470Install the US DoD CCEB Interoperability Root CA cross-certificate on unclassified systems. + +Issued To - Issued By - Thumbprint +DoD Root CA 2 - US DoD CCEB Interoperability Root CA 1 - DA36FAF56B2F6FBA1604F5BE46D864C9FA013BA3 + +DoD Root CA 3 - US DoD CCEB Interoperability Root CA 2 - 929BF3196896994C0A201DF4A5B71F603FEFBF2E + +Administrators should run the Federal Bridge Certification Authority (FBCA) Cross-Certificate Removal Tool once as an administrator and once as the current user. + +The FBCA Cross-Certificate Remover Tool and User Guide are available on IASE at http://iase.disa.mil/pki-pke/Pages/tools.aspx.This is applicable to unclassified systems. It is NA for others. + +Open "PowerShell" as an administrator. + +Execute the following command: + +Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter + +If the following certificate "Subject", "Issuer", and "Thumbprint" information is not displayed, this is a finding. + +If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. + +Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=US DoD CCEB Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: DA36FAF56B2F6FBA1604F5BE46D864C9FA013BA3 +NotAfter: 3/9/2019 + +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E +NotAfter: 9/27/2019 + +Alternately, use the Certificates MMC snap-in: + +Run "MMC". + +Select "File", "Add/Remove Snap-in". + +Select "Certificates" and click "Add". + +Select "Computer account" and click "Next". + +Select "Local computer: (the computer this console is running on)" and click "Finish". + +Click "OK". + +Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". + +For each certificate with "US DoD CCEB Interoperability Root CA ..." under "Issued By": + +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. + +Issued To: DoD Root CA 2 +Issued By: US DoD CCEB Interoperability Root CA 1 +Thumbprint: DA36FAF56B2F6FBA1604F5BE46D864C9FA013BA3 +Valid to: Saturday, March 9, 2019 + +Issued To: DoD Root CA 3 +Issuer by: US DoD CCEB Interoperability Root CA 2 +Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E +Valid: Friday, September 27, 2019SRG-OS-000067-GPOS-00035<GroupDescription></GroupDescription>WN19-SO-000350Windows Server 2019 users must be required to enter a password to access private keys stored on the computer.<VulnDiscussion>If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure. + +The cornerstone of the PKI is the private key used to encrypt or digitally sign information. + +If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user. + +Both the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000186Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System cryptography: Force strong key protection for user keys stored on the computer" to "User must enter a password each time they use a key".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\ + +Value Name: ForceKeyProtection + +Type: REG_DWORD +Value: 0x00000002 (2)SRG-OS-000120-GPOS-00061<GroupDescription></GroupDescription>WN19-SO-000290Windows Server 2019 Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.<VulnDiscussion>Certain encryption types are no longer considered secure. The DES and RC4 encryption suites must not be used for Kerberos encryption. + +Note: Organizations with domain controllers running earlier versions of Windows where RC4 encryption is enabled, selecting "The other domain supports Kerberos AES Encryption" on domain trusts, may be required to allow client communication across the trust relationship.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000803Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network security: Configure encryption types allowed for Kerberos" to "Enabled" with only the following selected: + +AES128_HMAC_SHA1 +AES256_HMAC_SHA1 +Future encryption types + +Note: Organizations with domain controllers running earlier versions of Windows where RC4 encryption is enabled, selecting "The other domain supports Kerberos AES Encryption" on domain trusts, may be required to allow client communication across the trust relationship.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\ + +Value Name: SupportedEncryptionTypes + +Value Type: REG_DWORD +Value: 0x7ffffff8 (2147483640)SRG-OS-000121-GPOS-00062<GroupDescription></GroupDescription>WN19-SO-000010Windows Server 2019 must have the built-in guest account disabled.<VulnDiscussion>A system faces an increased vulnerability threat if the built-in guest account is not disabled. This is a known account that exists on all Windows systems and cannot be deleted. This account is initialized during the installation of the operating system with no password assigned.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000804Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Guest account status" to "Disabled".Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. + +If the value for "Accounts: Guest account status" is not set to "Disabled", this is a finding. + +For server core installations, run the following command: + +Secedit /Export /Areas SecurityPolicy /CFG C:\Path\FileName.Txt + +If "EnableGuestAccount" equals "1" in the file, this is a finding.SRG-OS-000393-GPOS-00173<GroupDescription></GroupDescription>WN19-CC-000480Windows Server 2019 Windows Remote Management (WinRM) client must not allow unencrypted traffic.<VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this. + +Satisfies: SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002890CCI-003123Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Allow unencrypted traffic" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ + +Value Name: AllowUnencryptedTraffic + +Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000393-GPOS-00173<GroupDescription></GroupDescription>WN19-CC-000510Windows Server 2019 Windows Remote Management (WinRM) service must not allow unencrypted traffic.<VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this. + +Satisfies: SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002890CCI-003123Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Allow unencrypted traffic" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ + +Value Name: AllowUnencryptedTraffic + +Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000125-GPOS-00065<GroupDescription></GroupDescription>WN19-CC-000470Windows Server 2019 Windows Remote Management (WinRM) client must not use Basic authentication.<VulnDiscussion>Basic authentication uses plain-text passwords that could be used to compromise a system. Disabling Basic authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000877Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Allow Basic authentication" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ + +Value Name: AllowBasic + +Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000125-GPOS-00065<GroupDescription></GroupDescription>WN19-CC-000490Windows Server 2019 Windows Remote Management (WinRM) client must not use Digest authentication.<VulnDiscussion>Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks. Disallowing Digest authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000877Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Disallow Digest authentication" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ + +Value Name: AllowDigest + +Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000125-GPOS-00065<GroupDescription></GroupDescription>WN19-CC-000500Windows Server 2019 Windows Remote Management (WinRM) service must not use Basic authentication.<VulnDiscussion>Basic authentication uses plain-text passwords that could be used to compromise a system. Disabling Basic authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000877Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Allow Basic authentication" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ + +Value Name: AllowBasic + +Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000163-GPOS-00072<GroupDescription></GroupDescription>WN19-DC-000160Windows Server 2019 directory service must be configured to terminate LDAP-based network connections to the directory server after five minutes of inactivity.<VulnDiscussion>The failure to terminate inactive network connections increases the risk of a successful attack on the directory server. The longer an established session is in progress, the more time an attacker has to hijack the session, implement a means to passively intercept data, or compromise any protections on client access. For example, if an attacker gains control of a client computer, an existing (already authenticated) session with the directory server could allow access to the directory. The lack of confidentiality protection in LDAP-based sessions increases exposure to this vulnerability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001133Configure the directory service to terminate LDAP-based network connections to the directory server after 5 minutes of inactivity. + +Open an elevated "Command prompt" (run as administrator). + +Enter "ntdsutil". + +At the "ntdsutil:" prompt, enter "LDAP policies". + +At the "ldap policy:" prompt, enter "connections". + +At the "server connections:" prompt, enter "connect to server [host-name]" (where [host-name] is the computer name of the domain controller). + +At the "server connections:" prompt, enter "q". + +At the "ldap policy:" prompt, enter "Set MaxConnIdleTime to 300". + +Enter "Commit Changes" to save. + +Enter "Show values" to verify changes. + +Enter "q" at the "ldap policy:" and "ntdsutil:" prompts to exit.This applies to domain controllers. It is NA for other systems. + +Open an elevated "Command Prompt" (run as administrator). + +Enter "ntdsutil". + +At the "ntdsutil:" prompt, enter "LDAP policies". + +At the "ldap policy:" prompt, enter "connections". + +At the "server connections:" prompt, enter "connect to server [host-name]" +(where [host-name] is the computer name of the domain controller). + +At the "server connections:" prompt, enter "q". + +At the "ldap policy:" prompt, enter "show values". + +If the value for MaxConnIdleTime is greater than "300" (5 minutes) or is not specified, this is a finding. + +Enter "q" at the "ldap policy:" and "ntdsutil:" prompts to exit. + +Alternately, Dsquery can be used to display MaxConnIdleTime: + +Open "Command Prompt (Admin)". +Enter the following command (on a single line). + +dsquery * "cn=Default Query Policy,cn=Query-Policies,cn=Directory Service, cn=Windows NT,cn=Services,cn=Configuration,dc=[forest-name]" -attr LDAPAdminLimits + +The quotes are required and dc=[forest-name] is the fully qualified LDAP name of the domain being reviewed (e.g., dc=disaost,dc=mil). + +If the results do not specify a "MaxConnIdleTime" or it has a value greater than "300" (5 minutes), this is a finding.SRG-OS-000478-GPOS-00223<GroupDescription></GroupDescription>WN19-SO-000360Windows Server 2019 must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.<VulnDiscussion>This setting ensures the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing. FIPS-compliant algorithms meet specific standards established by the U.S. Government and must be the algorithms used for all OS encryption functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002450Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy\ + +Value Name: Enabled + +Value Type: REG_DWORD +Value: 0x00000001 (1) + +Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms. Both the browser and web server must be configured to use TLS; otherwise. the browser will not be able to connect to a secure site.SRG-OS-000396-GPOS-00176<GroupDescription></GroupDescription>WN19-DC-000140Windows Server 2019 must use separate, NSA-approved (Type 1) cryptography to protect the directory data in transit for directory service implementations at a classified confidentiality level when replication data traverses a network cleared to a lower level than the data.<VulnDiscussion>Directory data that is not appropriately encrypted is subject to compromise. Commercial-grade encryption does not provide adequate protection when the classification level of directory data in transit is higher than the level of the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002450Configure NSA-approved (Type 1) cryptography to protect the directory data in transit for directory service implementations at a classified confidentiality level that transfer replication data through a network cleared to a lower level than the data.This applies to domain controllers. It is NA for other systems. + +Review the organization network diagram(s) or documentation to determine the level of classification for the network(s) over which replication data is transmitted. + +Determine the classification level of the Windows domain controller. + +If the classification level of the Windows domain controller is higher than the level of the networks, review the organization network diagram(s) and directory implementation documentation to determine if NSA-approved encryption is used to protect the replication network traffic. + +If the classification level of the Windows domain controller is higher than the level of the network traversed and NSA-approved encryption is not used, this is a finding.SRG-OS-000185-GPOS-00079<GroupDescription></GroupDescription>WN19-00-000250Windows Server 2019 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.<VulnDiscussion>This requirement addresses protection of user-generated data as well as operating system-specific configuration data. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate, in accordance with the security category and/or classification of the information. + +Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields). + +Satisfies: SRG-OS-000185-GPOS-00079, SRG-OS-000404-GPOS-00183, SRG-OS-000405-GPOS-00184</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001199CCI-002475CCI-002476Configure systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data to employ encryption to protect the confidentiality and integrity of all information at rest.Verify systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data employ encryption to protect the confidentiality and integrity of all information at rest. + +If they do not, this is a finding.SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN19-CC-000240Windows Server 2019 administrator accounts must not be enumerated during elevation.<VulnDiscussion>Enumeration of administrator accounts when elevating can provide part of the logon information to an unauthorized user. This setting configures the system to always require users to type in a username and password to elevate a running application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001084Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Credential User Interface >> "Enumerate administrator accounts on elevation" to "Disabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\ + +Value Name: EnumerateAdministrators + +Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN19-MS-000020Windows Server 2019 local administrator accounts must have their privileged token filtered to prevent elevated privileges from being used over the network on domain-joined member servers.<VulnDiscussion>A compromised local administrator account can provide means for an attacker to move laterally between domain systems. + +With User Account Control enabled, filtering the privileged token for local administrator accounts will prevent the elevated privileges of these accounts from being used over the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001084Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Apply UAC restrictions to local accounts on network logons" to "Enabled". + +This policy setting requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and " SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.This applies to member servers. For domain controllers and standalone systems, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + +Value Name: LocalAccountTokenFilterPolicy + +Type: REG_DWORD +Value: 0x00000000 (0) + +This setting may cause issues with some network scanning tools if local administrative accounts are used remotely. Scans should use domain accounts where possible. If a local administrative account must be used, temporarily enabling the privileged token by configuring the registry value to "1" may be required.SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN19-SO-000390Windows Server 2019 UIAccess applications must not be allowed to prompt for elevation without using the secure desktop.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting prevents User Interface Accessibility programs from disabling the secure desktop for elevation prompts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001084Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop" to "Disabled".UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableUIADesktopToggle + +Value Type: REG_DWORD +Value: 0x00000000 (0)SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN19-SO-000400Windows Server 2019 User Account Control must, at a minimum, prompt administrators for consent on the secure desktop.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the elevation requirements for logged-on administrators to complete a task that requires raised privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001084Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" to "Prompt for consent on the secure desktop". + +The more secure option for this setting, "Prompt for credentials on the secure desktop", would also be acceptable.UAC requirements are NA for Server Core installations (this is default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: ConsentPromptBehaviorAdmin + +Value Type: REG_DWORD +Value: 0x00000002 (2) (Prompt for consent on the secure desktop) +0x00000001 (1) (Prompt for credentials on the secure desktop)SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN19-SO-000420Windows Server 2019 User Account Control must be configured to detect application installations and prompt for elevation.<VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting requires Windows to respond to application installation requests by prompting for credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001084Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Detect application installations and prompt for elevation" to "Enabled".UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableInstallerDetection + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN19-SO-000430Windows Server 2019 User Account Control (UAC) must only elevate UIAccess applications that are installed in secure locations.<VulnDiscussion>UAC is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures Windows to only allow applications installed in a secure location on the file system, such as the Program Files or the Windows\System32 folders, to run with elevated privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001084Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Only elevate UIAccess applications that are installed in secure locations" to "Enabled".UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableSecureUIAPaths + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000134-GPOS-00068<GroupDescription></GroupDescription>WN19-SO-000450Windows Server 2019 User Account Control (UAC) must virtualize file and registry write failures to per-user locations.<VulnDiscussion>UAC is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures non-UAC-compliant applications to run in virtualized file and registry entries in per-user locations, allowing them to run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001084Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "User Account Control: Virtualize file and registry write failures to per-user locations" to "Enabled".UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableVirtualization + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN19-00-000230Windows Server 2019 non-system-created file shares must limit access to groups that require it.<VulnDiscussion>Shares on a system provide network access. To prevent exposing sensitive information, where shares are necessary, permissions must be reconfigured to give the minimum access to accounts that require it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001090If a non-system-created share is required on a system, configure the share and NTFS permissions to limit access to the specific groups or accounts that require it. + +Remove any unnecessary non-system-created shares.If only system-created shares such as "ADMIN$", "C$", and "IPC$" exist on the system, this is NA. (System-created shares will display a message that it has been shared for administrative purposes when "Properties" is selected.) + +Run "Computer Management". + +Navigate to System Tools >> Shared Folders >> Shares. + +Right-click any non-system-created shares. + +Select "Properties". + +Select the "Share Permissions" tab. + +If the file shares have not been configured to restrict permissions to the specific groups or accounts that require access, this is a finding. + +Select the "Security" tab. + +If the permissions have not been configured to restrict permissions to the specific groups or accounts that require access, this is a finding.SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN19-CC-000350Windows Server 2019 Remote Desktop Services must prevent drive redirection.<VulnDiscussion>Preventing users from sharing the local drives on their client computers with Remote Session Hosts that they access helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001090Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Device and Resource Redirection >> "Do not allow drive redirection" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fDisableCdm + +Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN19-DC-000120Windows Server 2019 data files owned by users must be on a different logical partition from the directory server data files.<VulnDiscussion>When directory service data files, especially for directories used for identification, authentication, or authorization, reside on the same logical partition as user-owned files, the directory service data may be more vulnerable to unauthorized access or other availability compromises. Directory service and user-owned data files sharing a partition may be configured with less restrictive permissions in order to allow access to the user data. + +The directory service may be vulnerable to a denial of service attack when user-owned files on a common partition are expanded to an extent preventing the directory service from acquiring more space for directory or audit data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001090Move shares used to store files owned by users to a different logical partition than the directory server data files.This applies to domain controllers. It is NA for other systems. + +Run "Regedit". + +Navigate to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters". + +Note the directory locations in the values for "DSA Database file". + +Open "Command Prompt". + +Enter "net share". + +Note the logical drive(s) or file system partition for any organization-created data shares. + +Ignore system shares (e.g., NETLOGON, SYSVOL, and administrative shares ending in $). User shares that are hidden (ending with $) should not be ignored. + +If user shares are located on the same logical partition as the directory server data files, this is a finding.SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN19-SO-000230Windows Server 2019 must not allow anonymous enumeration of shares.<VulnDiscussion>Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001090Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Do not allow anonymous enumeration of SAM accounts and shares" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: RestrictAnonymous + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000138-GPOS-00069<GroupDescription></GroupDescription>WN19-SO-000250Windows Server 2019 must restrict anonymous access to Named Pipes and Shares.<VulnDiscussion>Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access. This setting restricts access to those defined in "Network access: Named Pipes that can be accessed anonymously" and "Network access: Shares that can be accessed anonymously", both of which must be blank under other requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001090Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Restrict anonymous access to Named Pipes and Shares" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: RestrictNullSessAccess + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000420-GPOS-00186<GroupDescription></GroupDescription>WN19-CC-000060Windows Server 2019 must be configured to ignore NetBIOS name release requests except from WINS servers.<VulnDiscussion>Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the server's WINS resolution capability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002385Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers" to "Enabled". + +This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netbt\Parameters\ + +Value Name: NoNameReleaseOnDemand + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000425-GPOS-00189<GroupDescription></GroupDescription>WN19-00-000260Windows Server 2019 must implement protection methods such as TLS, encrypted VPNs, or IPsec if the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process.<VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. + +Ensuring the confidentiality of transmitted information requires the operating system to take measures in preparing information for transmission. This can be accomplished via access control and encryption. + +Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, operating systems need to support transmission protection mechanisms such as TLS, encrypted VPNs, or IPsec. + +Satisfies: SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002420CCI-002422Configure protection methods such as TLS, encrypted VPNs, or IPsec when the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process.If the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, verify protection methods such as TLS, encrypted VPNs, or IPsec have been implemented. + +If protection methods have not been implemented, this is a finding.SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN19-DC-000320Windows Server 2019 domain controllers must require LDAP access signing.<VulnDiscussion>Unsigned network traffic is susceptible to man-in-the-middle attacks, where an intruder captures packets between the server and the client and modifies them before forwarding them to the client. In the case of an LDAP server, this means that an attacker could cause a client to make decisions based on false records from the LDAP directory. The risk of an attacker pulling this off can be decreased by implementing strong physical security measures to protect the network infrastructure. Furthermore, implementing Internet Protocol security (IPsec) authentication header mode (AH), which performs mutual authentication and packet integrity for Internet Protocol (IP) traffic, can make all types of man-in-the-middle attacks extremely difficult. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain controller: LDAP server signing requirements" to "Require signing".This applies to domain controllers. It is NA for other systems. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\NTDS\Parameters\ + +Value Name: LDAPServerIntegrity + +Value Type: REG_DWORD +Value: 0x00000002 (2)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN19-SO-000060Windows Server 2019 setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled.<VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted and signed. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally encrypt or sign secure channel data (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: RequireSignOrSeal + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN19-SO-000070Windows Server 2019 setting Domain member: Digitally encrypt secure channel data (when possible) must be configured to enabled.<VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally encrypt secure channel data (when possible)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: SealSecureChannel + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN19-SO-000080Windows Server 2019 setting Domain member: Digitally sign secure channel data (when possible) must be configured to Enabled.<VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked. If this policy is enabled, outgoing secure channel traffic will be signed. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Digitally sign secure channel data (when possible)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: SignSecureChannel + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN19-SO-000110Windows Server 2019 must be configured to require a strong session key.<VulnDiscussion>A computer connecting to a domain controller will establish a secure channel. The secure channel connection may be subject to compromise, such as hijacking or eavesdropping, if strong session keys are not used to establish the connection. Requiring strong session keys enforces 128-bit encryption between systems. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Domain member: Require strong (Windows 2000 or Later) session key" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: RequireStrongKey + +Value Type: REG_DWORD +Value: 0x00000001 (1) + +This setting may prevent a system from being joined to a domain if not configured consistently between systems.SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN19-SO-000160Windows Server 2019 setting Microsoft network client: Digitally sign communications (always) must be configured to Enabled.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network client: Digitally sign communications (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ + +Value Name: RequireSecuritySignature + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN19-SO-000170Windows Server 2019 setting Microsoft network client: Digitally sign communications (if server agrees) must be configured to Enabled.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. If this policy is enabled, the SMB client will request packet signing when communicating with an SMB server that is enabled or required to perform SMB packet signing. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network client: Digitally sign communications (if server agrees)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ + +Value Name: EnableSecuritySignature + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN19-SO-000190Windows Server 2019 setting Microsoft network server: Digitally sign communications (always) must be configured to Enabled.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network server: Digitally sign communications (always)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: RequireSecuritySignature + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>WN19-SO-000200Windows Server 2019 setting Microsoft network server: Digitally sign communications (if client agrees) must be configured to Enabled.<VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will negotiate SMB packet signing as requested by the client. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002418CCI-002421Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Microsoft network server: Digitally sign communications (if client agrees)" to "Enabled".If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: EnableSecuritySignature + +Value Type: REG_DWORD +Value: 0x00000001 (1)SRG-OS-000433-GPOS-00192<GroupDescription></GroupDescription>WN19-CC-000310Windows Server 2019 Explorer Data Execution Prevention must be enabled.<VulnDiscussion>Data Execution Prevention provides additional protection by performing checks on memory to help prevent malicious code from running. This setting will prevent Data Execution Prevention from being turned off for File Explorer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002824The default behavior is for data execution prevention to be turned on for File Explorer. + +If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Turn off Data Execution Prevention for Explorer" to "Not Configured" or "Disabled".The default behavior is for Data Execution Prevention to be turned on for File Explorer. + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ + +Value Name: NoDataExecutionPrevention + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist)SRG-OS-000433-GPOS-00193<GroupDescription></GroupDescription>WN19-EP-000020Windows Server 2019 Exploit Protection system-level mitigation, Randomize memory allocations (Bottom-Up ASLR), must be on.<VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Randomize memory allocations (Bottom-Up ASLR)", are enabled by default at the system level. Bottom-Up ASLR (address space layout randomization) randomizes locations for virtual memory allocations, including those for system structures. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-002824Ensure Exploit Protection system-level mitigation, "Randomize memory allocations (Bottom-Up ASLR)" is turned on. The default configuration in Exploit Protection is "On by default" which meets this requirement. + +Open "Windows Defender Security Center". + +Select "App & browser control". + +Select "Exploit protection settings". + +Under "System settings", configure "Randomize memory allocations (Bottom-Up ASLR)" to "On by default" or "Use default (<On>)". + +The STIG package includes a DoD EP XML file in the "Supporting Files" folder for configuring application mitigations defined in the STIG. This can also be modified to explicitly enforce the system level requirements. Adding the following to the XML file will explicitly turn Bottom-Up ASLR on (other system level EP requirements can be combined under <SystemConfig>): + +<SystemConfig> + <ASLR BottomUp="true" HighEntropy="true"></ASLR> +</SystemConfig> + +The XML file is applied with the group policy setting Computer Configuration >> Administrative Settings >> Windows Components >> Windows Defender Exploit Guard >> Exploit Protection >> "Use a common set of exploit protection settings" configured to "Enabled" with file name and location defined under "Options:". It is recommended the file be in a read-only network location.This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "ASLR: BottomUp" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration)SRG-OS-000191-GPOS-00080<GroupDescription></GroupDescription>WN19-00-000290Windows Server 2019 must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency: continuously, where Host Based Security System (HBSS) is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP).<VulnDiscussion>Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. The operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-001233Install a DoD approved HBSS software and ensure it is operating continuously.Verify DoD approved HBSS software is installed, configured, and properly operating. Ask the operator to document the HBSS software installation and configuration. + +If the operator is not able to provide a documented configuration for an installed HBSS or if the HBSS software is not properly configured, maintained, or used, this is a finding.SRG-OS-000480-GPOS-00231<GroupDescription></GroupDescription>WN19-00-000280Windows Server 2019 must have a host-based firewall installed and enabled.<VulnDiscussion>A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Windows 2019DISADPMS TargetWindows 20193483CCI-000366CCI-002080Install and enable a host-based firewall on the system.Determine if a host-based firewall is installed and enabled on the system. + +If a host-based firewall is not installed and enabled on the system, this is a finding. + +The configuration requirements will be determined by the applicable firewall STIG. diff --git a/StigData/Processed/IISSite-8.5-1.8.org.default.xml b/StigData/Processed/IISSite-8.5-1.8.org.default.xml index e7effe465..e9668f29f 100644 --- a/StigData/Processed/IISSite-8.5-1.8.org.default.xml +++ b/StigData/Processed/IISSite-8.5-1.8.org.default.xml @@ -14,7 +14,7 @@ - + diff --git a/StigData/Processed/Office-System2016-1.1.xml b/StigData/Processed/Office-System2016-1.1.xml index a4458fda1..af8b7c420 100644 --- a/StigData/Processed/Office-System2016-1.1.xml +++ b/StigData/Processed/Office-System2016-1.1.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>This policy setting controls whether the Help Improve Proofing Tools feature sends usage data to Microsoft. The Help Improve Proofing Tools feature collects data about use of the Proofing Tools, such as additions to the custom dictionary, and sends it to Microsoft. After about six months, the feature stops sending data to Microsoft and deletes the data collection file from the user's computer. If you enable this policy setting, this feature is enabled if users choose to participate in the Customer Experience Improvement Program (CEIP). If your organization has policies that govern the use of external resources such as the CEIP, allowing the use of the Help Improve Proofing Tools feature might cause them to violate these policies. If you disable this policy setting, the Help Improve Proofing Tools feature does not collect proofing tool usage information and transmit it to Microsoft. If you do not configure this policy setting, the behavior is the equivalent of setting the policy to "Enabled". @@ -11,7 +11,7 @@ Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Tools \ Options \ Spelling -> Proofing Data Collection "Improve Proofing Tools" is set to "Disabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\16.0\common\ptwatson @@ -31,7 +31,7 @@ Criteria: If the value PTWOptIn is REG_DWORD = 0, this is not a finding. Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings "Disable all Trust Bar notifications for security issues" is set to "Disabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\16.0\common\trustcenter @@ -51,7 +51,7 @@ Criteria: If the value TrustBar is REG_DWORD = 0, this is not a finding. Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings "Protect document metadata for rights managed Office Open XML Files" is set to "Enabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\16.0\common\security @@ -71,7 +71,7 @@ Criteria: If the value DRMEncryptProperty is REG_DWORD = 1, this is not a findin Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings "Protect document metadata for password protected files" is set to "Enabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\16.0\common\security @@ -89,9 +89,9 @@ Criteria: If the value OpenXMLEncryptProperty is REG_DWORD = 1, this is not a fi HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\common\security False - Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings "Encryption type for password protected Office Open XML files" is set to "Enabled (Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256)". + Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings "Encryption type for password protected Office Open XML files" is set to "Enabled (Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256)". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\16.0\common\security @@ -111,7 +111,7 @@ Criteria: If the value OpenXMLEncryption is REG_SZ = "Microsoft Enhanced RSA and Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings "Encryption type for password protected Office 97-2003 files" is set to "Enabled (Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256)". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\16.0\common\security @@ -131,7 +131,7 @@ Criteria: If the value DefaultEncryption12 is REG_SZ = "Microsoft Enhanced RSA a Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings "ActiveX Control Initialization" is set to "Disabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\Common\Security @@ -152,7 +152,7 @@ Criteria: If the value UFIControls exists, this is a finding. Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings "ActiveX Control Initialization" is set to "Disabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\Common\Security @@ -163,7 +163,7 @@ Criteria: If the value UFIControls exists, this is a finding. String - <VulnDiscussion>This policy setting allows you to control how ActiveX controls in UserForms should be initialized based upon whether they are Safe For Initialization (SFI) or Unsafefor Initialization (UFI). ActiveX controls are Component Object Model (COM) objects and have unrestricted access to users' computers. ActiveX controls can access the local file system and change the registry settings of the operating system. If a malicious user repurposes an ActiveX control to take over a user's computer, the effect could be significant. To help improve security, ActiveX developers can mark controls as Safe For Initialization (SFI), which means that the developer states that the controls are safe to open and run and not capable of causing harm to any computers. If a control is not marked SFI, the control could adversely affect a computer--or it's possible the developers did not test the control in all situations and are not sure whether their control might be compromised at some future date.SFI controls run in safe mode, which limits their access to the computer. For example, a worksheet control can both read and write files when it is in unsafe mode, but perhaps only read from files when it is in safe mode. This functionality allows the control to be used in very powerful ways when safety wasn't important, but the control would still be safe for use in a Web page. If a control is not marked as SFI, it is marked Unsafe For Initialization (UFI), which means that it is capable of affecting a user's computer. If UFI ActiveX controls are loaded, they are always loaded in unsafe mode. If you enable this policy setting, you can choose from four options for loading controls in UserForms: 1- For a UFI or SFI signed control that supports safe and unsafe mode, load the control in unsafe mode. For an SFI signed control that only supports a safe mode configuration, load the control in safe mode. This option enforces the default configuration. 2 - Users are prompted to determine how UserForm forms will load. The prompt only displays once per session within an application. When users respond to the prompt, loading continues based on whether the control is UFI or SFI: - For a UFI signed control, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control using the default properties. - For an SFI signed control that supports both safe and unsafe modes, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control using safe mode. If the SFI control can only support safe mode, load the control in safe mode. This option is the default configuration in the Microsoft Office 2016 release. 3 - Users are prompted to determine how UserForm forms will load. The prompt only displays once per session within an application. When users respond to the prompt, loading continues based on whether the control is UFI or SFI: - For a UFI signed control, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control with its default properties. - For an SFI signed control, load in safe mode. 4 - For a UFI signed control, load with the default properties of the control. For an SFI signed control, load in safe mode (considered to be the safest mode). If you disable or do not configure this policy setting, the behavior is as if you enable this policy setting and then select option 1. + <VulnDiscussion>This policy setting allows you to control how ActiveX controls in UserForms should be initialized based upon whether they are Safe For Initialization (SFI) or Unsafefor Initialization (UFI). ActiveX controls are Component Object Model (COM) objects and have unrestricted access to users' computers. ActiveX controls can access the local file system and change the registry settings of the operating system. If a malicious user repurposes an ActiveX control to take over a user's computer, the effect could be significant. To help improve security, ActiveX developers can mark controls as Safe For Initialization (SFI), which means that the developer states that the controls are safe to open and run and not capable of causing harm to any computers. If a control is not marked SFI, the control could adversely affect a computer--or it's possible the developers did not test the control in all situations and are not sure whether their control might be compromised at some future date.SFI controls run in safe mode, which limits their access to the computer. For example, a worksheet control can both read and write files when it is in unsafe mode, but perhaps only read from files when it is in safe mode. This functionality allows the control to be used in very powerful ways when safety wasn't important, but the control would still be safe for use in a Web page. If a control is not marked as SFI, it is marked Unsafe For Initialization (UFI), which means that it is capable of affecting a user's computer. If UFI ActiveX controls are loaded, they are always loaded in unsafe mode. If you enable this policy setting, you can choose from four options for loading controls in UserForms: 1- For a UFI or SFI signed control that supports safe and unsafe mode, load the control in unsafe mode. For an SFI signed control that only supports a safe mode configuration, load the control in safe mode. This option enforces the default configuration. 2 - Users are prompted to determine how UserForm forms will load. The prompt only displays once per session within an application. When users respond to the prompt, loading continues based on whether the control is UFI or SFI: - For a UFI signed control, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control using the default properties. - For an SFI signed control that supports both safe and unsafe modes, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control using safe mode. If the SFI control can only support safe mode, load the control in safe mode. This option is the default configuration in the Microsoft Office 2016 release. 3 - Users are prompted to determine how UserForm forms will load. The prompt only displays once per session within an application. When users respond to the prompt, loading continues based on whether the control is UFI or SFI: - For a UFI signed control, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control with its default properties. - For an SFI signed control, load in safe mode. 4 - For a UFI signed control, load with the default properties of the control. For an SFI signed control, load in safe mode (considered to be the safest mode). If you disable or do not configure this policy setting, the behavior is as if you enable this policy setting and then select option 1. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> Present @@ -173,9 +173,9 @@ Criteria: If the value UFIControls exists, this is a finding. Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings "Load Controls in Forms3" is set to "Disabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: - HKCU\keycupoliciesmsvbasecurity + HKCU\keycupoliciesmsvbasecurity Criteria: If the value LoadControlsInForms exists, this is a finding. @@ -183,7 +183,7 @@ Criteria: If the value LoadControlsInForms exists, this is a finding.String - <VulnDiscussion>This policy setting allows you to control how ActiveX controls in UserForms should be initialized based upon whether they are Safe For Initialization (SFI) or Unsafefor Initialization (UFI). ActiveX controls are Component Object Model (COM) objects and have unrestricted access to users' computers. ActiveX controls can access the local file system and change the registry settings of the operating system. If a malicious user repurposes an ActiveX control to take over a user's computer, the effect could be significant. To help improve security, ActiveX developers can mark controls as Safe For Initialization (SFI), which means that the developer states that the controls are safe to open and run and not capable of causing harm to any computers. If a control is not marked SFI, the control could adversely affect a computer--or it's possible the developers did not test the control in all situations and are not sure whether their control might be compromised at some future date.SFI controls run in safe mode, which limits their access to the computer. For example, a worksheet control can both read and write files when it is in unsafe mode, but perhaps only read from files when it is in safe mode. This functionality allows the control to be used in very powerful ways when safety wasn't important, but the control would still be safe for use in a Web page. If a control is not marked as SFI, it is marked Unsafe For Initialization (UFI), which means that it is capable of affecting a user's computer. If UFI ActiveX controls are loaded, they are always loaded in unsafe mode. If you enable this policy setting, you can choose from four options for loading controls in UserForms: 1- For a UFI or SFI signed control that supports safe and unsafe mode, load the control in unsafe mode. For an SFI signed control that only supports a safe mode configuration, load the control in safe mode. This option enforces the default configuration. 2 - Users are prompted to determine how UserForm forms will load. The prompt only displays once per session within an application. When users respond to the prompt, loading continues based on whether the control is UFI or SFI: - For a UFI signed control, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control using the default properties. - For an SFI signed control that supports both safe and unsafe modes, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control using safe mode. If the SFI control can only support safe mode, load the control in safe mode. This option is the default configuration in the Microsoft Office 2016 release. 3 - Users are prompted to determine how UserForm forms will load. The prompt only displays once per session within an application. When users respond to the prompt, loading continues based on whether the control is UFI or SFI: - For a UFI signed control, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control with its default properties. - For an SFI signed control, load in safe mode. 4 - For a UFI signed control, load with the default properties of the control. For an SFI signed control, load in safe mode (considered to be the safest mode). If you disable or do not configure this policy setting, the behavior is as if you enable this policy setting and then select option 1. + <VulnDiscussion>This policy setting allows you to control how ActiveX controls in UserForms should be initialized based upon whether they are Safe For Initialization (SFI) or Unsafefor Initialization (UFI). ActiveX controls are Component Object Model (COM) objects and have unrestricted access to users' computers. ActiveX controls can access the local file system and change the registry settings of the operating system. If a malicious user repurposes an ActiveX control to take over a user's computer, the effect could be significant. To help improve security, ActiveX developers can mark controls as Safe For Initialization (SFI), which means that the developer states that the controls are safe to open and run and not capable of causing harm to any computers. If a control is not marked SFI, the control could adversely affect a computer--or it's possible the developers did not test the control in all situations and are not sure whether their control might be compromised at some future date.SFI controls run in safe mode, which limits their access to the computer. For example, a worksheet control can both read and write files when it is in unsafe mode, but perhaps only read from files when it is in safe mode. This functionality allows the control to be used in very powerful ways when safety wasn't important, but the control would still be safe for use in a Web page. If a control is not marked as SFI, it is marked Unsafe For Initialization (UFI), which means that it is capable of affecting a user's computer. If UFI ActiveX controls are loaded, they are always loaded in unsafe mode. If you enable this policy setting, you can choose from four options for loading controls in UserForms: 1- For a UFI or SFI signed control that supports safe and unsafe mode, load the control in unsafe mode. For an SFI signed control that only supports a safe mode configuration, load the control in safe mode. This option enforces the default configuration. 2 - Users are prompted to determine how UserForm forms will load. The prompt only displays once per session within an application. When users respond to the prompt, loading continues based on whether the control is UFI or SFI: - For a UFI signed control, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control using the default properties. - For an SFI signed control that supports both safe and unsafe modes, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control using safe mode. If the SFI control can only support safe mode, load the control in safe mode. This option is the default configuration in the Microsoft Office 2016 release. 3 - Users are prompted to determine how UserForm forms will load. The prompt only displays once per session within an application. When users respond to the prompt, loading continues based on whether the control is UFI or SFI: - For a UFI signed control, if users respond Yes to the prompt, load the control in unsafe mode. If users respond No, load the control with its default properties. - For an SFI signed control, load in safe mode. 4 - For a UFI signed control, load with the default properties of the control. For an SFI signed control, load in safe mode (considered to be the safest mode). If you disable or do not configure this policy setting, the behavior is as if you enable this policy setting and then select option 1. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> Absent @@ -193,9 +193,9 @@ Criteria: If the value LoadControlsInForms exists, this is a finding. Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings "Load Controls in Forms3" is set to "Disabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: - HKCU\keycupoliciesmsvbasecurity + HKCU\keycupoliciesmsvbasecurity Criteria: If the value LoadControlsInForms exists, this is a finding. @@ -213,7 +213,7 @@ Criteria: If the value LoadControlsInForms exists, this is a finding. Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings "Automation Security" is set to "Enabled (Use application macro security level)". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\Common\Security @@ -233,7 +233,7 @@ Criteria: If the value AutomationSecurity is REG_DWORD = 2, this is not a findin Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings -> Trust Center "Allow mix of policy and user locations" is set to "Disabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\16.0\common\security\trusted locations @@ -254,7 +254,7 @@ Criteria: If the value Allow User Locations is REG_DWORD = 0, this is not a find Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Smart Documents (Word, Excel) "Disable Smart Document's use of manifests" is set to "Enabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\Common\Smart Tag @@ -274,7 +274,7 @@ Criteria: If the value NeverLoadManifests is REG_DWORD = 1, this is not a findin Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Manage Restricted Permissions "Always require users to connect to verify permission" is set to "Enabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\16.0\common\drm @@ -294,7 +294,7 @@ Criteria: If the value RequireConnection is REG_DWORD = 1, this is not a finding Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Microsoft Save As PDF and XPS add-ins "Disable inclusion of document properties in PDF and XPS output" is set to "Enabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\16.0\common\fixedformat @@ -312,9 +312,9 @@ Criteria: If the value DisableFixedFormatDocProperties is REG_DWORD = 1, this is HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\common\security False - Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings "Encrypt document properties" is set to "Enabled". + Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings "Encrypt document properties" is set to "Enabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\16.0\common\security @@ -334,9 +334,9 @@ Criteria: If the value EncryptDocProps is REG_DWORD = 1, this is not a finding.< Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Present Online -> "Remove Office Presentation Service from the list of online presentation services in PowerPoint and Word" is set to "Enabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: -HKCU\software\policies\Microsoft\office\16.0\common\broadcast +HKCU\software\policies\Microsoft\office\16.0\common\broadcast Criteria: If the value disabledefaultservice is REG_DWORD = 1, this is not a finding. 1 @@ -354,9 +354,9 @@ Criteria: If the value disabledefaultservice is REG_DWORD = 1, this is not a fin Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Present Online -> "Restrict programmatic access for creating online presentations in PowerPoint and Word" is set to "Enabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: -HKCU\software\policies\Microsoft\office\16.0\common\broadcast +HKCU\software\policies\Microsoft\office\16.0\common\broadcast Criteria: If the value disableprogrammaticaccess is REG_DWORD = 1, this is not a finding. 1 @@ -374,7 +374,7 @@ Criteria: If the value disableprogrammaticaccess is REG_DWORD = 1, this is not a Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Privacy -> Trust Center -> "Allow including screenshot with Office Feedback" is set to "Disabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\software\policies\Microsoft\office\16.0\common\feedback @@ -394,7 +394,7 @@ Criteria: If the value includescreenshot is REG_DWORD = 0, this is not a finding Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings -> Trust Center -> Trusted Catalogs "Allow Unsecure web add-ins and Catalogs" is set to "Disabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\software\policies\Microsoft\office\16.0\wef\trustedcatalogs @@ -414,7 +414,7 @@ Criteria: If the value requireserververification is REG_DWORD = 1, this is not a Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Telemetry Dashboard -> "Turn on privacy setting in Office Telemetry Agent" is set to "Enabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\software\policies\Microsoft\office\16.0\osm @@ -434,7 +434,7 @@ Criteria: If the value enablefileobfuscation is REG_DWORD = 1, this is not a fin Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Privacy -> Trust Center -> "Send personal information" is set to "Disabled". -Procedure: Use the Windows Registry Editor to navigate to the following key: +Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\software\policies\Microsoft\office\16.0\common diff --git a/StigData/Processed/WindowsServer-2012R2-DC-2.17.xml b/StigData/Processed/WindowsServer-2012R2-DC-2.17.xml index 2ec7d8c70..d8bf58f7a 100644 --- a/StigData/Processed/WindowsServer-2012R2-DC-2.17.xml +++ b/StigData/Processed/WindowsServer-2012R2-DC-2.17.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -2333,6 +2333,223 @@ Principal - Everyone Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions) Inherited from - Parent Object Applies to - Descendant Organization Unit Objects + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> + + False + False + + Verify the auditing configuration for the Domain object. + +Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) +Ensure Advanced Features is selected in the View menu. +Select the domain being reviewed in the left pane. +Right click the domain name and select Properties. +Select the Security tab. +Select the Advanced button and then the Auditing tab. + +If the audit settings on the Domain object are not at least as inclusive as those below, this is a finding. + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. + +Two instances with the following summary information will be listed. +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - None +Applies to - Special + +Type - Success +Principal - Domain Users +Access - All extended rights +Inherited from - None +Applies to - This object only + +Type - Success +Principal - Administrators +Access - All extended rights +Inherited from - None +Applies to - This object only + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner) + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Infrastructure object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> + + False + False + + Verify the auditing configuration for Infrastructure object. + +Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) +Ensure Advanced Features is selected in the View menu. +Select the domain being reviewed in the left pane. +Right click the Infrastructure object in the right pane and select Properties. +Select the Security tab. +Select the Advanced button and then the Auditing tab. + +If the audit settings on the Infrastructure object are not at least as inclusive as those below, this is a finding. + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master) + +Two instances with the following summary information will be listed. +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain Controller OU object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> + + False + False + + Verify the auditing configuration for the Domain Controller OU object. + +Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) +Ensure Advanced Features is selected in the View menu. +Select the Domain Controllers OU under the domain being reviewed in the left pane. +Right click the Domain Controllers OU object and select Properties. +Select the Security tab. +Select the Advanced button and then the Auditing tab. + +If the audit settings on the Domain Controllers OU object are not at least as inclusive as those below, this is a finding. + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object and all descendant objects + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: all create, delete and modify permissions) + +Type - Success +Principal - Everyone +Access - Write all properties +Inherited from - None +Applies to - This object and all descendant objects + +Two instances with the following summary information will be listed. +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objects + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the AdminSDHolder object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> + + False + False + + Verify the auditing configuration for the AdminSDHolder object. + +Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) +Ensure Advanced Features is selected in the View menu. +Select System under the domain being reviewed in the left pane. +Right click the AdminSDHolder object in the right pane and select Properties. +Select the Security tab. +Select the Advanced button and then the Auditing tab. + +If the audit settings on the AdminSDHolder object are not at least as inclusive as those below, this is a finding. + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Write all properties, Modify permissions, Modify owner) + +Two instances with the following summary information will be listed. +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objects + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the RID Manager$ object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> + + False + False + + Verify the auditing configuration for the RID Manager$ object. + +Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) +Ensure Advanced Features is selected in the View menu. +Select System under the domain being reviewed in the left pane. +Right-click the RID Manager$ object in the right pane and select Properties. +Select the Security tab. +Select the Advanced button and then the Auditing tab. + +If the audit settings on the RID Manager$ object are not at least as inclusive as those below, this is a finding. + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None + (Access - Special = Write all properties, All extended rights, Change RID master) + +Two instances with the following summary information will be listed. +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) <VulnDiscussion>When Active Directory (AD) objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. @@ -2976,387 +3193,6 @@ Administrators - Full Control The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder. If the permissions for these files are not as restrictive as the ACLs listed, this is a finding. - - - - - Fail - Everyone - False - - - FullControl - - - Success - Everyone - False - - - blank - - - Success - Domain Users - False - - - AllExtendedRights - - - Success - Administrators - False - - - AllExtendedRights - - - Success - Everyone - False - - - WriteallProperties,ModifyPermissions,ModifyOwner - - - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> - - False - False - False - - {Domain} - Verify the auditing configuration for the Domain object. - -Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) -Ensure Advanced Features is selected in the View menu. -Select the domain being reviewed in the left pane. -Right click the domain name and select Properties. -Select the Security tab. -Select the Advanced button and then the Auditing tab. - -If the audit settings on the Domain object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object only - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - None -Applies to - Special - -Type - Success -Principal - Domain Users -Access - All extended rights -Inherited from - None -Applies to - This object only - -Type - Success -Principal - Administrators -Access - All extended rights -Inherited from - None -Applies to - This object only - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner) - - - - - Fail - Everyone - False - - - FullControl - - - Success - Everyone - False - - - WriteallProperties,AllExtendedRights,ChangeInfrastructureMaster - - - Success - Everyone - False - - - blank - - - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Infrastructure object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> - - False - False - False - - CN=Infrastructure,{Domain} - Verify the auditing configuration for Infrastructure object. - -Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) -Ensure Advanced Features is selected in the View menu. -Select the domain being reviewed in the left pane. -Right click the Infrastructure object in the right pane and select Properties. -Select the Security tab. -Select the Advanced button and then the Auditing tab. - -If the audit settings on the Infrastructure object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master) - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) - - - - - Fail - Everyone - False - - - FullControl - - - Success - Everyone - False - - - Createallchildobjects,Delete,ModifyPermissions - - - Success - Everyone - False - - - WriteallProperties - - - Success - Everyone - False - - - blank - - - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain Controller OU object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> - - False - False - False - - OU=Domain Controllers,{Domain} - Verify the auditing configuration for the Domain Controller OU object. - -Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) -Ensure Advanced Features is selected in the View menu. -Select the Domain Controllers OU under the domain being reviewed in the left pane. -Right click the Domain Controllers OU object and select Properties. -Select the Security tab. -Select the Advanced button and then the Auditing tab. - -If the audit settings on the Domain Controllers OU object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object and all descendant objects - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Permissions: all create, delete and modify permissions) - -Type - Success -Principal - Everyone -Access - Write all properties -Inherited from - None -Applies to - This object and all descendant objects - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) -Applies to - Descendant Organizational Unit objects - - - - - Fail - Everyone - False - - - FullControl - - - Success - Everyone - False - - - WriteallProperties,ModifyPermissions,ModifyOwner - - - Success - Everyone - False - - - blank - - - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the AdminSDHolder object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> - - False - False - False - - CN=AdminSDHolder,CN=System,{Domain} - Verify the auditing configuration for the AdminSDHolder object. - -Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) -Ensure Advanced Features is selected in the View menu. -Select System under the domain being reviewed in the left pane. -Right click the AdminSDHolder object in the right pane and select Properties. -Select the Security tab. -Select the Advanced button and then the Auditing tab. - -If the audit settings on the AdminSDHolder object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object only - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Write all properties, Modify permissions, Modify owner) - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) -Applies to - Descendant Organizational Unit objects - - - - - Fail - Everyone - False - - - FullControl - - - Success - Everyone - False - - - WriteallProperties,AllExtendedRights,ChangeRIDMaster - - - Success - Everyone - False - - - blank - - - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the RID Manager$ object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> - - False - False - False - - CN=RID Manager$,CN=System,{Domain} - Verify the auditing configuration for the RID Manager$ object. - -Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) -Ensure Advanced Features is selected in the View menu. -Select System under the domain being reviewed in the left pane. -Right-click the RID Manager$ object in the right pane and select Properties. -Select the Security tab. -Select the Advanced button and then the Auditing tab. - -If the audit settings on the RID Manager$ object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None - (Access - Special = Write all properties, All extended rights, Change RID master) - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) diff --git a/StigData/Processed/WindowsServer-2012R2-DC-2.18.xml b/StigData/Processed/WindowsServer-2012R2-DC-2.18.xml index b65cec4c7..aa0d5fb3e 100644 --- a/StigData/Processed/WindowsServer-2012R2-DC-2.18.xml +++ b/StigData/Processed/WindowsServer-2012R2-DC-2.18.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -2333,6 +2333,223 @@ Principal - Everyone Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions) Inherited from - Parent Object Applies to - Descendant Organization Unit Objects + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> + + False + False + + Verify the auditing configuration for the Domain object. + +Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) +Ensure Advanced Features is selected in the View menu. +Select the domain being reviewed in the left pane. +Right click the domain name and select Properties. +Select the Security tab. +Select the Advanced button and then the Auditing tab. + +If the audit settings on the Domain object are not at least as inclusive as those below, this is a finding. + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. + +Two instances with the following summary information will be listed. +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - None +Applies to - Special + +Type - Success +Principal - Domain Users +Access - All extended rights +Inherited from - None +Applies to - This object only + +Type - Success +Principal - Administrators +Access - All extended rights +Inherited from - None +Applies to - This object only + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner) + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Infrastructure object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> + + False + False + + Verify the auditing configuration for Infrastructure object. + +Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) +Ensure Advanced Features is selected in the View menu. +Select the domain being reviewed in the left pane. +Right click the Infrastructure object in the right pane and select Properties. +Select the Security tab. +Select the Advanced button and then the Auditing tab. + +If the audit settings on the Infrastructure object are not at least as inclusive as those below, this is a finding. + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master) + +Two instances with the following summary information will be listed. +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain Controller OU object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> + + False + False + + Verify the auditing configuration for the Domain Controller OU object. + +Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) +Ensure Advanced Features is selected in the View menu. +Select the Domain Controllers OU under the domain being reviewed in the left pane. +Right click the Domain Controllers OU object and select Properties. +Select the Security tab. +Select the Advanced button and then the Auditing tab. + +If the audit settings on the Domain Controllers OU object are not at least as inclusive as those below, this is a finding. + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object and all descendant objects + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: all create, delete and modify permissions) + +Type - Success +Principal - Everyone +Access - Write all properties +Inherited from - None +Applies to - This object and all descendant objects + +Two instances with the following summary information will be listed. +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objects + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the AdminSDHolder object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> + + False + False + + Verify the auditing configuration for the AdminSDHolder object. + +Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) +Ensure Advanced Features is selected in the View menu. +Select System under the domain being reviewed in the left pane. +Right click the AdminSDHolder object in the right pane and select Properties. +Select the Security tab. +Select the Advanced button and then the Auditing tab. + +If the audit settings on the AdminSDHolder object are not at least as inclusive as those below, this is a finding. + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Write all properties, Modify permissions, Modify owner) + +Two instances with the following summary information will be listed. +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objects + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the RID Manager$ object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> + + False + False + + Verify the auditing configuration for the RID Manager$ object. + +Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) +Ensure Advanced Features is selected in the View menu. +Select System under the domain being reviewed in the left pane. +Right-click the RID Manager$ object in the right pane and select Properties. +Select the Security tab. +Select the Advanced button and then the Auditing tab. + +If the audit settings on the RID Manager$ object are not at least as inclusive as those below, this is a finding. + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None + (Access - Special = Write all properties, All extended rights, Change RID master) + +Two instances with the following summary information will be listed. +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) <VulnDiscussion>When Active Directory (AD) objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. @@ -2976,387 +3193,6 @@ Administrators - Full Control The default location is the "%SystemRoot%\SYSTEM32\WINEVT\LOGS" directory. They may have been moved to another folder. If the permissions for these files are not as restrictive as the ACLs listed, this is a finding. - - - - - Fail - Everyone - False - - - FullControl - - - Success - Everyone - False - - - blank - - - Success - Domain Users - False - - - AllExtendedRights - - - Success - Administrators - False - - - AllExtendedRights - - - Success - Everyone - False - - - WriteallProperties,ModifyPermissions,ModifyOwner - - - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> - - False - False - False - - {Domain} - Verify the auditing configuration for the Domain object. - -Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) -Ensure Advanced Features is selected in the View menu. -Select the domain being reviewed in the left pane. -Right click the domain name and select Properties. -Select the Security tab. -Select the Advanced button and then the Auditing tab. - -If the audit settings on the Domain object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object only - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - None -Applies to - Special - -Type - Success -Principal - Domain Users -Access - All extended rights -Inherited from - None -Applies to - This object only - -Type - Success -Principal - Administrators -Access - All extended rights -Inherited from - None -Applies to - This object only - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner) - - - - - Fail - Everyone - False - - - FullControl - - - Success - Everyone - False - - - WriteallProperties,AllExtendedRights,ChangeInfrastructureMaster - - - Success - Everyone - False - - - blank - - - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Infrastructure object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> - - False - False - False - - CN=Infrastructure,{Domain} - Verify the auditing configuration for Infrastructure object. - -Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) -Ensure Advanced Features is selected in the View menu. -Select the domain being reviewed in the left pane. -Right click the Infrastructure object in the right pane and select Properties. -Select the Security tab. -Select the Advanced button and then the Auditing tab. - -If the audit settings on the Infrastructure object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master) - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) - - - - - Fail - Everyone - False - - - FullControl - - - Success - Everyone - False - - - Createallchildobjects,Delete,ModifyPermissions - - - Success - Everyone - False - - - WriteallProperties - - - Success - Everyone - False - - - blank - - - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain Controller OU object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> - - False - False - False - - OU=Domain Controllers,{Domain} - Verify the auditing configuration for the Domain Controller OU object. - -Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) -Ensure Advanced Features is selected in the View menu. -Select the Domain Controllers OU under the domain being reviewed in the left pane. -Right click the Domain Controllers OU object and select Properties. -Select the Security tab. -Select the Advanced button and then the Auditing tab. - -If the audit settings on the Domain Controllers OU object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object and all descendant objects - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Permissions: all create, delete and modify permissions) - -Type - Success -Principal - Everyone -Access - Write all properties -Inherited from - None -Applies to - This object and all descendant objects - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) -Applies to - Descendant Organizational Unit objects - - - - - Fail - Everyone - False - - - FullControl - - - Success - Everyone - False - - - WriteallProperties,ModifyPermissions,ModifyOwner - - - Success - Everyone - False - - - blank - - - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the AdminSDHolder object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> - - False - False - False - - CN=AdminSDHolder,CN=System,{Domain} - Verify the auditing configuration for the AdminSDHolder object. - -Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) -Ensure Advanced Features is selected in the View menu. -Select System under the domain being reviewed in the left pane. -Right click the AdminSDHolder object in the right pane and select Properties. -Select the Security tab. -Select the Advanced button and then the Auditing tab. - -If the audit settings on the AdminSDHolder object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None -Applies to - This object only - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None -Applies to - This object only -(Access - Special = Write all properties, Modify permissions, Modify owner) - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) -Applies to - Descendant Organizational Unit objects - - - - - Fail - Everyone - False - - - FullControl - - - Success - Everyone - False - - - WriteallProperties,AllExtendedRights,ChangeRIDMaster - - - Success - Everyone - False - - - blank - - - <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. - -For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the RID Manager$ object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls>ECAR-1, ECAR-2, ECAR-3</IAControls> - - False - False - False - - CN=RID Manager$,CN=System,{Domain} - Verify the auditing configuration for the RID Manager$ object. - -Open "Active Directory Users and Computers". (Available from various menus or run "dsa.msc".) -Ensure Advanced Features is selected in the View menu. -Select System under the domain being reviewed in the left pane. -Right-click the RID Manager$ object in the right pane and select Properties. -Select the Security tab. -Select the Advanced button and then the Auditing tab. - -If the audit settings on the RID Manager$ object are not at least as inclusive as those below, this is a finding. - -Type - Fail -Principal - Everyone -Access - Full Control -Inherited from - None - -The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference, various Properties selections may also exist by default. - -Type - Success -Principal - Everyone -Access - Special -Inherited from - None - (Access - Special = Write all properties, All extended rights, Change RID master) - -Two instances with the following summary information will be listed. -Type - Success -Principal - Everyone -Access - (blank) -Inherited from - (CN of domain) diff --git a/StigData/Processed/WindowsServer-2016-DC-1.8.xml b/StigData/Processed/WindowsServer-2016-DC-1.8.xml index 218da3654..aa9679b18 100644 --- a/StigData/Processed/WindowsServer-2016-DC-1.8.xml +++ b/StigData/Processed/WindowsServer-2016-DC-1.8.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>This policy setting determines whether the Kerberos Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the target computer. The policy is enabled by default, which is the most secure setting for validating that access to target resources is not circumvented. @@ -1536,6 +1536,66 @@ Enterprise Admins - Read, Write, Create all child objects, Delete all child obje ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions The Domain Admins and Enterprise Admins will not have the "Delete all child objects" permission on the two default Group Policy objects: Default Domain Policy and Default Domain Controllers Policy. They will have this permission on organization created Group Policy objects. + + + <VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. + +For Active Directory, the OU objects require special attention. In a distributed administration model (i.e., help desk), OU objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for OU objects, it could allow an intruder to add or delete users in the OU. This could result in unauthorized access to data or a denial of service to authorized users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Review the permissions on domain-defined OUs. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +For each OU that is defined (folder in folder icon) excluding the Domain Controllers OU: + +Right-click the OU and select "Properties". + +Select the "Security" tab. + +If the permissions on the OU are not at least as restrictive as those below, this is a finding. + +The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "Edit" or "View" button. + +Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. + +CREATOR OWNER - Special permissions + +Self - Special permissions + +Authenticated Users - Read, Special permissions + +The Special permissions for Authenticated Users are Read type. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +SYSTEM - Full Control + +Domain Admins - Full Control + +Enterprise Admins - Full Control + +Key Admins - Special permissions + +Enterprise Key Admins - Special permissions + +Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Pre-Windows 2000 Compatible Access - Special permissions + +The Special permissions for Pre-Windows 2000 Compatible Access are for Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + +If an ISSO-approved distributed administration model (help desk or other user support staff) is implemented, permissions above Read may be allowed for groups documented by the ISSO. + +If any OU with improper permissions includes identification or authentication data (e.g., accounts, passwords, or password hash data) used by systems to determine access control, the severity is CAT I (e.g., OUs that include user accounts, including service/application accounts). + +If an OU with improper permissions does not include identification and authentication data used by systems to determine access control, the severity is CAT II (e.g., Workstation, Printer OUs). <VulnDiscussion>Directory data that is not appropriately encrypted is subject to compromise. Commercial-grade encryption does not provide adequate protection when the classification level of directory data in transit is higher than the level of the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -2225,66 +2285,6 @@ The Special permissions for Pre-Windows 2000 Compatible Access are Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions - - - <VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. - -For Active Directory, the OU objects require special attention. In a distributed administration model (i.e., help desk), OU objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for OU objects, it could allow an intruder to add or delete users in the OU. This could result in unauthorized access to data or a denial of service to authorized users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - This applies to domain controllers. It is NA for other systems. - -Review the permissions on domain-defined OUs. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -For each OU that is defined (folder in folder icon) excluding the Domain Controllers OU: - -Right-click the OU and select "Properties". - -Select the "Security" tab. - -If the permissions on the OU are not at least as restrictive as those below, this is a finding. - -The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "Edit" or "View" button. - -Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. - -CREATOR OWNER - Special permissions - -Self - Special permissions - -Authenticated Users - Read, Special permissions - -The Special permissions for Authenticated Users are Read type. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -SYSTEM - Full Control - -Domain Admins - Full Control - -Enterprise Admins - Full Control - -Key Admins - Special permissions - -Enterprise Key Admins - Special permissions - -Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Pre-Windows 2000 Compatible Access - Special permissions - -The Special permissions for Pre-Windows 2000 Compatible Access are for Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions - -If an ISSO-approved distributed administration model (help desk or other user support staff) is implemented, permissions above Read may be allowed for groups documented by the ISSO. - -If any OU with improper permissions includes identification or authentication data (e.g., accounts, passwords, or password hash data) used by systems to determine access control, the severity is CAT I (e.g., OUs that include user accounts, including service/application accounts). - -If an OU with improper permissions does not include identification and authentication data used by systems to determine access control, the severity is CAT II (e.g., Workstation, Printer OUs). <VulnDiscussion>When directory service data files, especially for directories used for identification, authentication, or authorization, reside on the same logical partition as user-owned files, the directory service data may be more vulnerable to unauthorized access or other availability compromises. Directory service and user-owned data files sharing a partition may be configured with less restrictive permissions in order to allow access to the user data. diff --git a/StigData/Processed/WindowsServer-2016-DC-1.9.xml b/StigData/Processed/WindowsServer-2016-DC-1.9.xml index 1150e18fc..01c4e2a47 100644 --- a/StigData/Processed/WindowsServer-2016-DC-1.9.xml +++ b/StigData/Processed/WindowsServer-2016-DC-1.9.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>This policy setting determines whether the Kerberos Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the target computer. The policy is enabled by default, which is the most secure setting for validating that access to target resources is not circumvented. @@ -1546,6 +1546,66 @@ Enterprise Admins - Read, Write, Create all child objects, Delete all child obje ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions The Domain Admins and Enterprise Admins will not have the "Delete all child objects" permission on the two default Group Policy objects: Default Domain Policy and Default Domain Controllers Policy. They will have this permission on organization created Group Policy objects. + + + <VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. + +For Active Directory, the OU objects require special attention. In a distributed administration model (i.e., help desk), OU objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for OU objects, it could allow an intruder to add or delete users in the OU. This could result in unauthorized access to data or a denial of service to authorized users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Review the permissions on domain-defined OUs. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +For each OU that is defined (folder in folder icon) excluding the Domain Controllers OU: + +Right-click the OU and select "Properties". + +Select the "Security" tab. + +If the permissions on the OU are not at least as restrictive as those below, this is a finding. + +The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "Edit" or "View" button. + +Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. + +CREATOR OWNER - Special permissions + +Self - Special permissions + +Authenticated Users - Read, Special permissions + +The Special permissions for Authenticated Users are Read type. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +SYSTEM - Full Control + +Domain Admins - Full Control + +Enterprise Admins - Full Control + +Key Admins - Special permissions + +Enterprise Key Admins - Special permissions + +Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Pre-Windows 2000 Compatible Access - Special permissions + +The Special permissions for Pre-Windows 2000 Compatible Access are for Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + +If an ISSO-approved distributed administration model (help desk or other user support staff) is implemented, permissions above Read may be allowed for groups documented by the ISSO. + +If any OU with improper permissions includes identification or authentication data (e.g., accounts, passwords, or password hash data) used by systems to determine access control, the severity is CAT I (e.g., OUs that include user accounts, including service/application accounts). + +If an OU with improper permissions does not include identification and authentication data used by systems to determine access control, the severity is CAT II (e.g., Workstation, Printer OUs). <VulnDiscussion>Directory data that is not appropriately encrypted is subject to compromise. Commercial-grade encryption does not provide adequate protection when the classification level of directory data in transit is higher than the level of the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -2225,66 +2285,6 @@ The Special permissions for Pre-Windows 2000 Compatible Access are Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions - - - <VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. - -For Active Directory, the OU objects require special attention. In a distributed administration model (i.e., help desk), OU objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for OU objects, it could allow an intruder to add or delete users in the OU. This could result in unauthorized access to data or a denial of service to authorized users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - False - False - - This applies to domain controllers. It is NA for other systems. - -Review the permissions on domain-defined OUs. - -Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). - -Ensure "Advanced Features" is selected in the "View" menu. - -For each OU that is defined (folder in folder icon) excluding the Domain Controllers OU: - -Right-click the OU and select "Properties". - -Select the "Security" tab. - -If the permissions on the OU are not at least as restrictive as those below, this is a finding. - -The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "Edit" or "View" button. - -Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. - -CREATOR OWNER - Special permissions - -Self - Special permissions - -Authenticated Users - Read, Special permissions - -The Special permissions for Authenticated Users are Read type. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -SYSTEM - Full Control - -Domain Admins - Full Control - -Enterprise Admins - Full Control - -Key Admins - Special permissions - -Enterprise Key Admins - Special permissions - -Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions - -Pre-Windows 2000 Compatible Access - Special permissions - -The Special permissions for Pre-Windows 2000 Compatible Access are for Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. - -ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions - -If an ISSO-approved distributed administration model (help desk or other user support staff) is implemented, permissions above Read may be allowed for groups documented by the ISSO. - -If any OU with improper permissions includes identification or authentication data (e.g., accounts, passwords, or password hash data) used by systems to determine access control, the severity is CAT I (e.g., OUs that include user accounts, including service/application accounts). - -If an OU with improper permissions does not include identification and authentication data used by systems to determine access control, the severity is CAT II (e.g., Workstation, Printer OUs). <VulnDiscussion>When directory service data files, especially for directories used for identification, authentication, or authorization, reside on the same logical partition as user-owned files, the directory service data may be more vulnerable to unauthorized access or other availability compromises. Directory service and user-owned data files sharing a partition may be configured with less restrictive permissions in order to allow access to the user data. diff --git a/StigData/Processed/WindowsServer-2019-DC-1.2.org.default.xml b/StigData/Processed/WindowsServer-2019-DC-1.2.org.default.xml new file mode 100644 index 000000000..af2fa86b2 --- /dev/null +++ b/StigData/Processed/WindowsServer-2019-DC-1.2.org.default.xml @@ -0,0 +1,65 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/StigData/Processed/WindowsServer-2019-DC-1.2.xml b/StigData/Processed/WindowsServer-2019-DC-1.2.xml new file mode 100644 index 000000000..dfe6b0600 --- /dev/null +++ b/StigData/Processed/WindowsServer-2019-DC-1.2.xml @@ -0,0 +1,8386 @@ + + + + <VulnDiscussion>This policy setting determines whether the Kerberos Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the target computer. The policy is enabled by default, which is the most secure setting for validating that access to target resources is not circumvented. + +Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Enforce user logon restrictions + Enabled + This applies to domain controllers. It is NA for other systems. + +Verify the following is configured in the Default Domain Policy: + +Open "Group Policy Management". + +Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). + +Right-click on the "Default Domain Policy". + +Select "Edit". + +Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. + +If the "Enforce user logon restrictions" is not set to "Enabled", this is a finding. + + + <VulnDiscussion>This setting determines the maximum amount of time (in minutes) that a granted session ticket can be used to access a particular service. Session tickets are used only to authenticate new connections with servers. Ongoing operations are not interrupted if the session ticket used to authenticate the connection expires during the connection. + +Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -le '600' -and '{0}' -ne '0' + Maximum lifetime for service ticket + + This applies to domain controllers. It is NA for other systems. + +Verify the following is configured in the Default Domain Policy: + +Open "Group Policy Management". + +Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). + +Right-click on the "Default Domain Policy". + +Select "Edit". + +Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. + +If the value for "Maximum lifetime for service ticket" is "0" or greater than "600" minutes, this is a finding. + + + <VulnDiscussion>In Kerberos, there are two types of tickets: Ticket Granting Tickets (TGTs) and Service Tickets. Kerberos tickets have a limited lifetime so the time an attacker has to implement an attack is limited. This policy controls how long TGTs can be renewed. With Kerberos, the user's initial authentication to the domain controller results in a TGT, which is then used to request Service Tickets to resources. Upon startup, each computer gets a TGT before requesting a service ticket to the domain controller and any other computers it needs to access. For services that start up under a specified user account, users must always get a TGT first and then get Service Tickets to all computers and services accessed. + +Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -le '10' -and '{0}' -ne '0' + Maximum lifetime for user ticket + + This applies to domain controllers. It is NA for other systems. + +Verify the following is configured in the Default Domain Policy: + +Open "Group Policy Management". + +Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). + +Right-click on the "Default Domain Policy". + +Select "Edit". + +Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. + +If the value for "Maximum lifetime for user ticket" is "0" or greater than "10" hours, this is a finding. + + + <VulnDiscussion>This setting determines the period of time (in days) during which a user's Ticket Granting Ticket (TGT) may be renewed. This security configuration limits the amount of time an attacker has to crack the TGT and gain access. + +Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -le '7' + Maximum lifetime for user ticket renewal + + This applies to domain controllers. It is NA for other systems. + +Verify the following is configured in the Default Domain Policy: + +Open "Group Policy Management". + +Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). + +Right-click on the "Default Domain Policy". + +Select "Edit". + +Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. + +If the "Maximum lifetime for user ticket renewal" is greater than "7" days, this is a finding. + + + <VulnDiscussion>This setting determines the maximum time difference (in minutes) that Kerberos will tolerate between the time on a client's clock and the time on a server's clock while still considering the two clocks synchronous. In order to prevent replay attacks, Kerberos uses timestamps as part of its protocol definition. For timestamps to work properly, the clocks of the client and the server need to be in sync as much as possible. + +Satisfies: SRG-OS-000112-GPOS-00057, SRG-OS-000113-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -le '5' + Maximum tolerance for computer clock synchronization + + This applies to domain controllers. It is NA for other systems. + +Verify the following is configured in the Default Domain Policy: + +Open "Group Policy Management". + +Navigate to "Group Policy Objects" in the Domain being reviewed (Forest >> Domains >> Domain). + +Right-click on the "Default Domain Policy". + +Select "Edit". + +Navigate to Computer Configuration >> Policies >> Windows Settings >> Security Settings >> Account Policies >> Kerberos Policy. + +If the "Maximum tolerance for computer clock synchronization" is greater than "5" minutes, this is a finding. + + + <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack while allowing for honest errors made during normal user logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -le '3' -and '{0}' -ne '0' + Account lockout threshold + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. + +If the "Account lockout threshold" is "0" or more than "3" attempts, this is a finding. + + + + + <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to "0". The smaller this value is, the less effective the account lockout feature will be in protecting the local system. + +Satisfies: SRG-OS-000021-GPOS-00005, SRG-OS-000329-GPOS-00128</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -ge '15' + Reset account lockout counter after + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. + +If the "Reset account lockout counter after" value is less than "15" minutes, this is a finding. + + + + + <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that an account will remain locked after the specified number of failed logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -ge '15' -or '{0}' -eq '0' + Account lockout duration + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. + +If the "Account lockout duration" is less than "15" minutes (excluding "0"), this is a finding. + + + + + <VulnDiscussion>The use of complex passwords increases their strength against attack. The built-in Windows password complexity policy requires passwords to contain at least three of the four types of characters (numbers, uppercase and lowercase letters, and special characters) and prevents the inclusion of user names or parts of user names. + +Satisfies: SRG-OS-000069-GPOS-00037, SRG-OS-000070-GPOS-00038, SRG-OS-000071-GPOS-00039, SRG-OS-000266-GPOS-00101</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Password must meet complexity requirements + Enabled + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for "Password must meet complexity requirements" is not set to "Enabled", this is a finding. + + + + + <VulnDiscussion>Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system and compromising the device, information, or the local network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -ge '14' + Minimum password length + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for the "Minimum password length," is less than "14" characters, this is a finding. + + + + + <VulnDiscussion>Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords, which are easily compromised. For this reason, this policy must never be enabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Store passwords using reversible encryption + Disabled + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for "Store passwords using reversible encryption" is not set to "Disabled", this is a finding. + + + + + <VulnDiscussion>Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database. This enables users to effectively negate the purpose of mandating periodic password changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -ne '0' + Minimum password age + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for the "Minimum password age" is set to "0" days ("Password can be changed immediately"), this is a finding. + + + + + <VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -le '60' -and '{0}' -ne '0' + Maximum password age + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for the "Maximum password age" is greater than "60" days, this is a finding. + +If the value is set to "0" (never expires), this is a finding. + + + + + <VulnDiscussion>A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change to a unique password on a regularly scheduled basis. This enables users to effectively negate the purpose of mandating periodic password changes. The default value is "24" for Windows domain systems. DoD has decided this is the appropriate value for all Windows systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -ge '24' + Enforce password history + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for "Enforce password history" is less than "24" passwords remembered, this is a finding. + + + + + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed. + +Satisfies: SRG-OS-000032-GPOS-00013, SRG-OS-000470-GPOS-00214, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000475-GPOS-00220</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Logon - Success + Logon + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed. + +Satisfies: SRG-OS-000032-GPOS-00013, SRG-OS-000470-GPOS-00214, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000475-GPOS-00220</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Logon - Failure + Logon + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Security Group Management records events such as creating, deleting, or changing security groups, including changes in group members. + +Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Management >> Security Group Management - Success + Security Group Management + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts. + +Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Management >> User Account Management - Success + User Account Management + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts. + +Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Management >> User Account Management - Failure + User Account Management + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Computer Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling computer accounts. + +Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + This applies to domain controllers. It is NA for other systems. + +Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Management >> Computer Account Management - Success + Computer Account Management + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Account Lockout events can be used to identify potentially malicious logon attempts. + +Satisfies: SRG-OS-000240-GPOS-00090, SRG-OS-000470-GPOS-00214</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Account Lockout - Success + Account Lockout + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Account Lockout events can be used to identify potentially malicious logon attempts. + +Satisfies: SRG-OS-000240-GPOS-00090, SRG-OS-000470-GPOS-00214</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Account Lockout - Failure + Account Lockout + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Other Account Management Events records events such as the access of a password hash or the Password Policy Checking API being called. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding: + +Account Management >> Other Account Management Events - Success + Other Account Management Events + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Process Creation records events related to the creation of a process and the source. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000471-GPOS-00215</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Detailed Tracking >> Process Creation - Success + Process Creation + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Policy Change records events related to changes in audit policy. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Policy Change >> Audit Policy Change - Success + Audit Policy Change + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Policy Change records events related to changes in audit policy. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Policy Change >> Audit Policy Change - Failure + Audit Policy Change + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Authentication Policy Change records events related to changes in authentication policy, including Kerberos policy and Trust changes. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Policy Change >> Authentication Policy Change - Success + Authentication Policy Change + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Authorization Policy Change records events related to changes in user rights, such as "Create a token object". + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Policy Change >> Authorization Policy Change - Success + Authorization Policy Change + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs". + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Privilege Use >> Sensitive Privilege Use - Success + Sensitive Privilege Use + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs". + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Privilege Use >> Sensitive Privilege Use - Failure + Sensitive Privilege Use + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +IPsec Driver records events related to the IPsec Driver, such as dropped packets. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> IPsec Driver - Success + IPsec Driver + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +IPsec Driver records events related to the IPsec Driver, such as dropped packets. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> IPsec Driver - Failure + IPsec Driver + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> Other System Events - Success + Other System Events + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> Other System Events - Failure + Other System Events + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Security State Change records events related to changes in the security state, such as startup and shutdown of the system. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> Security State Change - Success + Security State Change + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Security System Extension records events related to extension code being loaded by the security subsystem. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> Security System Extension - Success + Security System Extension + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +System Integrity records events related to violations of integrity to the security subsystem. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> System Integrity - Success + System Integrity + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +System Integrity records events related to violations of integrity to the security subsystem. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> System Integrity - Failure + System Integrity + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Directory Service Access records events related to users accessing an Active Directory object. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + This applies to domain controllers. It is NA for other systems. + +Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +DS Access >> Directory Service Access - Success + Directory Service Access + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Directory Service Access records events related to users accessing an Active Directory object. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + This applies to domain controllers. It is NA for other systems. + +Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +DS Access >> Directory Service Access - Failure + Directory Service Access + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Directory Service Changes records events related to changes made to objects in Active Directory Domain Services. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + This applies to domain controllers. It is NA for other systems. + +Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +DS Access >> Directory Service Changes - Success + Directory Service Changes + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Directory Service Changes records events related to changes made to objects in Active Directory Domain Services. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + This applies to domain controllers. It is NA for other systems. + +Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +DS Access >> Directory Service Changes - Failure + Directory Service Changes + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Credential Validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Logon >> Credential Validation - Success + Credential Validation + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Credential Validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Logon >> Credential Validation - Failure + Credential Validation + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Plug and Play activity records events related to the successful connection of external devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Detailed Tracking >> Plug and Play Events - Success + Plug and Play Events + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Group Membership records information related to the group membership of a user's logon token.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Group Membership - Success + Group Membership + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Special Logon records special logons that have administrative privileges and can be used to elevate processes. + +Satisfies: SRG-OS-000470-GPOS-00214, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000475-GPOS-00220</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Special Logon - Success + Special Logon + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Auditing for other object access records events related to the management of task scheduler jobs and COM+ objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Object Access >> Other Object Access Events - Success + Other Object Access Events + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Auditing for other object access records events related to the management of task scheduler jobs and COM+ objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Object Access >> Other Object Access Events - Failure + Other Object Access Events + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Object Access >> Removable Storage - Success + +Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding. + Removable Storage + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Object Access >> Removable Storage - Failure + +Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding. + Removable Storage + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Logoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed. + +Satisfies: SRG-OS-000472-GPOS-00217, SRG-OS-000480-GPOS-00227</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Logoff - Success + Logoff + + + + + <VulnDiscussion>The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system. To support this, volumes must be formatted using a file system that supports NTFS attributes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + NTFS|ReFS + + False + -match + False + + FileSystem + SELECT * FROM Win32_LogicalDisk WHERE DriveType = '3' + Open "Computer Management". + +Select "Disk Management" under "Storage". + +For each local volume, if the file system does not indicate "NTFS", this is a finding. + +"ReFS" (resilient file system) is also acceptable and would not be a finding. + +This does not apply to system partitions such the Recovery and EFI System Partition. + + + <VulnDiscussion>Systems at unsupported servicing levels will not receive security updates for new vulnerabilities, which leave them subject to exploitation. Systems must be maintained at a servicing level supported by the vendor with new security updates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + 10.0.17763 + + False + -le + False + + Version + SELECT * FROM Win32_OperatingSystem + Open "Command Prompt". + +Enter "winver.exe". + +If the "About Windows" dialog box does not display "Microsoft Windows Server Version 1809 (Build 17763.xxx)" or greater, this is a finding. + +Preview versions must not be used in a production environment. + + + + + <VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems relying on the directory service. + +For Active Directory (AD), the Group Policy objects require special attention. In a distributed administration model (i.e., help desk), Group Policy objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for Group Policy objects, this could allow an intruder to change the security policy applied to all domain client computers (workstations and servers).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Review the permissions on Group Policy objects. + +Open "Group Policy Management" (available from various menus or run "gpmc.msc"). + +Navigate to "Group Policy Objects" in the domain being reviewed (Forest >> Domains >> Domain). + +For each Group Policy object: + +Select the Group Policy object item in the left pane. + +Select the "Delegation" tab in the right pane. + +Select the "Advanced" button. + +Select each Group or user name. + +View the permissions. + +If any standard user accounts or groups have "Allow" permissions greater than "Read" and "Apply group policy", this is a finding. + +Other access permissions that allow the objects to be updated are considered findings unless specifically documented by the ISSO. + +The default permissions noted below satisfy this requirement. + +The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the next "Advanced" button, the desired Permission entry, and the "Edit" button. + +Authenticated Users - Read, Apply group policy, Special permissions + +The special permissions for Authenticated Users are for Read-type Properties. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +The special permissions for the following default groups are not the focus of this requirement and may include a wide range of permissions and properties: + +CREATOR OWNER - Special permissions +SYSTEM - Read, Write, Create all child objects, Delete all child objects, Special permissions +Domain Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions +Enterprise Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + +The Domain Admins and Enterprise Admins will not have the "Delete all child objects" permission on the two default Group Policy objects: Default Domain Policy and Default Domain Controllers Policy. They will have this permission on organization created Group Policy objects. + + + <VulnDiscussion>When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. + +For Active Directory, the OU objects require special attention. In a distributed administration model (i.e., help desk), OU objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for OU objects, it could allow an intruder to add or delete users in the OU. This could result in unauthorized access to data or a denial of service (DoS) to authorized users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Review the permissions on domain-defined OUs. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +For each OU that is defined (folder in folder icon) excluding the Domain Controllers OU: + +Right-click the OU and select "Properties". + +Select the "Security" tab. + +If the Allow type permissions on the OU are not at least as restrictive as those below, this is a finding. + +The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "Edit" or "View" button. + +Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. + +CREATOR OWNER - Special permissions + +Self - Special permissions + +Authenticated Users - Read, Special permissions + +The Special permissions for Authenticated Users are Read type. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +SYSTEM - Full Control + +Domain Admins - Full Control + +Enterprise Admins - Full Control + +Key Admins - Special permissions + +Enterprise Key Admins - Special permissions + +Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Pre-Windows 2000 Compatible Access - Special permissions + +The Special permissions for Pre-Windows 2000 Compatible Access are for Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + +If an ISSO-approved distributed administration model (help desk or other user support staff) is implemented, permissions above Read may be allowed for groups documented by the ISSO. + +If any OU with improper permissions includes identification or authentication data (e.g., accounts, passwords, or password hash data) used by systems to determine access control, the severity is CAT I (e.g., OUs that include user accounts, including service/application accounts). + +If an OU with improper permissions does not include identification and authentication data used by systems to determine access control, the severity is CAT II (e.g., Workstation, Printer OUs). + + + <VulnDiscussion>A properly configured Host-based Intrusion Detection System (HIDS) or Host-based Intrusion Prevention System (HIPS) provides another level of defense against unauthorized access to critical servers. With proper configuration and logging enabled, such a system can stop and/or alert for many attempts to gain unauthorized access to resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine whether there is a HIDS or HIPS on each server. + +If the HIPS component of HBSS is installed and active on the host and the alerts of blocked activity are being logged and monitored, this meets the requirement. + +A HIDS device is not required on a system that has the role as the Network Intrusion Device (NID). However, this exception needs to be documented with the ISSO. + +If a HIDS is not installed on the system, this is a finding. + + + <VulnDiscussion>Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Search all drives for *.p12 and *.pfx files. + +If any files with these extensions exist, this is a finding. + +This does not apply to server-based applications that have a requirement for .p12 certificate files or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO. + + + <VulnDiscussion>Unnecessary roles and features increase the attack surface of a system. Limiting roles and features of a system to only those necessary reduces this potential. The standard installation option (previously called Server Core) further reduces this when selected at installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Required roles and features will vary based on the function of the individual system. + +Roles and features specifically required to be disabled per the STIG are identified in separate requirements. + +If the organization has not documented the roles and features required for the system(s), this is a finding. + +The PowerShell command "Get-WindowsFeature" will list all roles and features with an "Install State". + + + <VulnDiscussion>Shared accounts (accounts where two or more people log on with the same user identification) do not provide adequate identification and authentication. There is no way to provide for nonrepudiation or individual accountability for system access and resource usage.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine whether any shared accounts exist. If no shared accounts exist, this is NA. + +Shared accounts, such as required by an application, may be approved by the organization. This must be documented with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity. + +If unapproved shared accounts exist, this is a finding. + + + <VulnDiscussion>Outdated or unused accounts provide penetration points that may go undetected. Inactive accounts must be deleted if no longer necessary or, if still required, disabled until needed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Open "Windows PowerShell". + +Domain Controllers: + +Enter "Search-ADAccount -AccountInactive -UsersOnly -TimeSpan 35.00:00:00" + +This will return accounts that have not been logged on to for 35 days, along with various attributes such as the Enabled status and LastLogonDate. + +Member servers and standalone systems: + +Copy or enter the lines below to the PowerShell window and enter. (Entering twice may be required. Do not include the quotes at the beginning and end of the query.) + +"([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach { + $user = ([ADSI]$_.Path) + $lastLogin = $user.Properties.LastLogin.Value + $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2 + if ($lastLogin -eq $null) { + $lastLogin = 'Never' + } + Write-Host $user.Name $lastLogin $enabled +}" + +This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False). +For example: User1 10/31/2015 5:49:56 AM True + +Review the list of accounts returned by the above queries to determine the finding validity for each account reported. + +Exclude the following accounts: + +- Built-in administrator account (Renamed, SID ending in 500) +- Built-in guest account (Renamed, Disabled, SID ending in 501) +- Application accounts + +If any enabled accounts have not been logged on to within the past 35 days, this is a finding. + +Inactive accounts that have been reviewed and deemed to be required must be documented with the ISSO. + + + <VulnDiscussion>A PKI implementation depends on the practices established by the Certificate Authority (CA) to ensure the implementation is secure. Without proper practices, the certificates issued by a CA have limited value in authentication functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Review user account mappings to PKI certificates. + +Open "Windows PowerShell". + +Enter "Get-ADUser -Filter * | FT Name, UserPrincipalName, Enabled". + +Exclude disabled accounts (e.g., DefaultAccount, Guest) and the krbtgt account. + +If the User Principal Name (UPN) is not in the format of an individual's identifier for the certificate type and for the appropriate domain suffix, this is a finding. + +For standard NIPRNet certificates, the individual's identifier is in the format of an Electronic Data Interchange - Personnel Identifier (EDI-PI). + +Alt Tokens and other certificates may use a different UPN format than the EDI-PI which vary by organization. Verified these with the organization. + +NIPRNet Example: + +Name - User Principal Name +User1 - 1234567890@mil + +See PKE documentation for other network domain suffixes. + +If the mappings are to certificates issued by a CA authorized by the Component's CIO, this is a CAT II finding. + + + <VulnDiscussion>To ensure secure DoD websites and DoD-signed code are properly validated, the system must trust the DoD Root CAs. The DoD root certificates will ensure that the trust chain is established for server certificates issued from the DoD CAs. + +Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + The certificates and thumbprints referenced below apply to unclassified systems; see PKE documentation for other networks. + +Open "Windows PowerShell" as an administrator. + +Execute the following command: + +Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*DoD*" | FL Subject, Thumbprint, NotAfter + +If the following certificate "Subject" and "Thumbprint" information is not displayed, this is a finding. + +If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. + +Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561 +NotAfter: 12/5/2029 + +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB +NotAfter: 12/30/2029 + +Subject: CN=DoD Root CA 4, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026 +NotAfter: 7/25/2032 + +Subject: CN=DoD Root CA 5, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B +NotAfter: 6/14/2041 + +Alternately, use the Certificates MMC snap-in: + +Run "MMC". + +Select "File", "Add/Remove Snap-in". + +Select "Certificates" and click "Add". + +Select "Computer account" and click "Next". + +Select "Local computer: (the computer this console is running on)" and click "Finish". + +Click "OK". + +Expand "Certificates" and navigate to "Trusted Root Certification Authorities >> Certificates". + +For each of the DoD Root CA certificates noted below: + +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the DoD Root CA certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. + +DoD Root CA 2 +Thumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561 +Valid to: Wednesday, December 5, 2029 + +DoD Root CA 3 +Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB +Valid to: Sunday, December 30, 2029 + +DoD Root CA 4 +Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026 +Valid to: Sunday, July 25, 2032 + +DoD Root CA 5 +Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B +Valid to: Friday, June 14, 2041 + + + <VulnDiscussion>Directory data that is not appropriately encrypted is subject to compromise. Commercial-grade encryption does not provide adequate protection when the classification level of directory data in transit is higher than the level of the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Review the organization network diagram(s) or documentation to determine the level of classification for the network(s) over which replication data is transmitted. + +Determine the classification level of the Windows domain controller. + +If the classification level of the Windows domain controller is higher than the level of the networks, review the organization network diagram(s) and directory implementation documentation to determine if NSA-approved encryption is used to protect the replication network traffic. + +If the classification level of the Windows domain controller is higher than the level of the network traversed and NSA-approved encryption is not used, this is a finding. + + + <VulnDiscussion>Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. The operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify DoD approved HBSS software is installed, configured, and properly operating. Ask the operator to document the HBSS software installation and configuration. + +If the operator is not able to provide a documented configuration for an installed HBSS or if the HBSS software is not properly configured, maintained, or used, this is a finding. + + + + + <VulnDiscussion>If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation. + +Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. + +If temporary accounts are used, the operating system must be configured to automatically terminate these types of accounts after a DoD-defined time period of 72 hours. + +To address access requirements, many operating systems may be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review temporary user accounts for expiration dates. + +Determine if temporary user accounts are used and identify any that exist. If none exist, this is NA. + +Domain Controllers: + +Open "PowerShell". + +Enter "Search-ADAccount -AccountExpiring | FT Name, AccountExpirationDate". + +If "AccountExpirationDate" has not been defined within 72 hours for any temporary user account, this is a finding. + +Member servers and standalone systems: + +Open "Command Prompt". + +Run "Net user [username]", where [username] is the name of the temporary user account. + +If "Account expires" has not been defined within 72 hours for any temporary user account, this is a finding. + + + <VulnDiscussion>Emergency administrator accounts are privileged accounts established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability. + +Emergency administrator accounts are different from infrequently used accounts (i.e., local logon accounts used by system administrators when network or normal logon/access is not available). Infrequently used accounts are not subject to automatic termination dates. Emergency accounts are accounts created in response to crisis situations, usually for use by maintenance personnel. The automatic expiration or disabling time period may be extended as needed until the crisis is resolved; however, it must not be extended indefinitely. A permanent account should be established for privileged users who need long-term maintenance accounts. + +To address access requirements, many operating systems can be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine if emergency administrator accounts are used and identify any that exist. If none exist, this is NA. + +If emergency administrator accounts cannot be configured with an expiration date due to an ongoing crisis, the accounts must be disabled or removed when the crisis is resolved. + +If emergency administrator accounts have not been configured with an expiration date or have not been disabled or removed following the resolution of a crisis, this is a finding. + +Domain Controllers: + +Open "PowerShell". + +Enter "Search-ADAccount -AccountExpiring | FT Name, AccountExpirationDate". + +If "AccountExpirationDate" has been defined and is not within 72 hours for an emergency administrator account, this is a finding. + +Member servers and standalone systems: + +Open "Command Prompt". + +Run "Net user [username]", where [username] is the name of the emergency account. + +If "Account expires" has been defined and is not within 72 hours for an emergency administrator account, this is a finding. + + + <VulnDiscussion>Windows shares are a means by which files, folders, printers, and other resources can be published for network users to access. Improper configuration can permit access to devices and data beyond a user's need.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Open "Printers & scanners" in "Settings". + +If there are no printers configured, this is NA. (Exclude Microsoft Print to PDF and Microsoft XPS Document Writer, which do not support sharing.) + +For each printer: + +Select the printer and "Manage". + +Select "Printer Properties". + +Select the "Sharing" tab. + +If "Share this printer" is checked, select the "Security" tab. + +If any standard user accounts or groups have permissions other than "Print", this is a finding. + +The default is for the "Everyone" group to be given "Print" permission. + +"All APPLICATION PACKAGES" and "CREATOR OWNER" are not standard user accounts. + + + <VulnDiscussion>An account that does not have Administrator duties must not have Administrator rights. Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack. + +System administrators must log on to systems using only accounts with the minimum level of authority necessary. + +Standard user accounts must not be members of the built-in Administrators group.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. A separate version applies to other systems. + +Review the Administrators group. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group. + +Standard user accounts must not be members of the local administrator group. + +If prohibited accounts are members of the local administrators group, this is a finding. + +If the built-in Administrator account or other required administrative accounts are found on the system, this is not a finding. + + + <VulnDiscussion>Improper access permissions for directory data-related files could allow unauthorized users to read, modify, or delete directory data or audit trails.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Run "Regedit". + +Navigate to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters". + +Note the directory locations in the values for: + +Database log files path +DSA Database file + +By default, they will be \Windows\NTDS. + +If the locations are different, the following will need to be run for each. + +Open "Command Prompt (Admin)". + +Navigate to the NTDS directory (\Windows\NTDS by default). + +Run "icacls *.*". + +If the permissions on each file are not as restrictive as the following, this is a finding: + +NT AUTHORITY\SYSTEM:(I)(F) +BUILTIN\Administrators:(I)(F) + +(I) - permission inherited from parent container +(F) - full access + + + <VulnDiscussion>When Active Directory objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service. + +The Domain Controllers OU object requires special attention as the Domain Controllers are central to the configuration and management of the domain. Inappropriate access permissions defined for the Domain Controllers OU could allow an intruder or unauthorized personnel to make changes that could lead to the compromise of the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Review the permissions on the Domain Controllers OU. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Select "Advanced Features" in the "View" menu if not previously selected. + +Select the "Domain Controllers" OU (folder in folder icon). + +Right-click and select "Properties". + +Select the "Security" tab. + +If the permissions on the Domain Controllers OU do not restrict changes to System, Domain Admins, Enterprise Admins and Administrators, this is a finding. + +The default permissions listed below satisfy this requirement. + +Domains supporting Microsoft Exchange will have additional Exchange related permissions on the Domain Controllers OU. These may include some change related permissions and are not a finding. + +The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "View" or "Edit" button. + +Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement. + +CREATOR OWNER - Special permissions + +SELF - Special permissions + +Authenticated Users - Read, Special permissions + +The special permissions for Authenticated Users are Read types. + +If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +SYSTEM - Full Control + +Domain Admins - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Enterprise Admins - Full Control + +Key Admins - Special permissions + +Enterprise Key Admins - Special permissions + +Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions + +Pre-Windows 2000 Compatible Access - Special permissions + +The Special permissions for Pre-Windows 2000 Compatible Access are Read types. + +If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding. + +ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes Group Policy objects. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for all Group Policy objects. + +Open "Group Policy Management" (available from various menus or run "gpmc.msc"). + +Navigate to "Group Policy Objects" in the domain being reviewed (Forest >> Domains >> Domain). + +For each Group Policy object: + +Select the Group Policy object item in the left pane. + +Select the "Delegation" tab in the right pane. + +Select the "Advanced" button. + +Select the "Advanced" button again and then the "Auditing" tab. + +If the audit settings for any Group Policy object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Applies to - This object and all descendant objects or Descendant groupPolicyContainer objects + +The three Success types listed below are defaults inherited from the Parent Object. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. + +Type - Success +Principal - Everyone +Access - Special (Permissions: Write all properties, Modify permissions; Properties: all "Write" type selected) +Inherited from - Parent Object +Applies to - Descendant groupPolicyContainer objects + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions) +Inherited from - Parent Object +Applies to - Descendant Organization Unit Objects + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for the Domain object. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select the domain being reviewed in the left pane. + +Right-click the domain name and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +If the audit settings on the Domain object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - None +Applies to - Special + +Type - Success +Principal - Domain Users +Access - All extended rights +Inherited from - None +Applies to - This object only + +Type - Success +Principal - Administrators +Access - All extended rights +Inherited from - None +Applies to - This object only + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner) + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Infrastructure object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for Infrastructure object. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select the domain being reviewed in the left pane. + +Right-click the "Infrastructure" object in the right pane and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +If the audit settings on the Infrastructure object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master) + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the Domain Controller OU object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for the Domain Controller OU object. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select the "Domain Controllers OU" under the domain being reviewed in the left pane. + +Right-click the "Domain Controllers OU" object and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +If the audit settings on the Domain Controllers OU object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object and all descendant objects + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Permissions: all create, delete and modify permissions) + +Type - Success +Principal - Everyone +Access - Write all properties +Inherited from - None +Applies to - This object and all descendant objects + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objects + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the AdminSDHolder object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for the "AdminSDHolder" object. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select "System" under the domain being reviewed in the left pane. + +Right-click the "AdminSDHolder" object in the right pane and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +If the audit settings on the "AdminSDHolder" object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None +Applies to - This object only + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None +Applies to - This object only +(Access - Special = Write all properties, Modify permissions, Modify owner) + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) +Applies to - Descendant Organizational Unit objects + + + <VulnDiscussion>When inappropriate audit settings are configured for directory service database objects, it may be possible for a user or process to update the data without generating any tracking data. The impact of missing audit data is related to the type of object. A failure to capture audit data for objects used by identification, authentication, or authorization functions could degrade or eliminate the ability to track changes to access policy for systems or data. + +For Active Directory (AD), there are a number of critical object types in the domain naming context of the AD database for which auditing is essential. This includes the RID Manager$ object. Because changes to these objects can significantly impact access controls or the availability of systems, the absence of auditing data makes it impossible to identify the source of changes that impact the confidentiality, integrity, and availability of data and systems throughout an AD domain. The lack of proper auditing can result in insufficient forensic evidence needed to investigate an incident and prosecute the intruder. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Review the auditing configuration for the "RID Manager$" object. + +Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). + +Ensure "Advanced Features" is selected in the "View" menu. + +Select "System" under the domain being reviewed in the left pane. + +Right-click the "RID Manager$" object in the right pane and select "Properties". + +Select the "Security" tab. + +Select the "Advanced" button and then the "Auditing" tab. + +If the audit settings on the "RID Manager$" object are not at least as inclusive as those below, this is a finding: + +Type - Fail +Principal - Everyone +Access - Full Control +Inherited from - None + +The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default. + +Type - Success +Principal - Everyone +Access - Special +Inherited from - None + (Access - Special = Write all properties, All extended rights, Change RID master) + +Two instances with the following summary information will be listed: + +Type - Success +Principal - Everyone +Access - (blank) +Inherited from - (CN of domain) + + + <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine if a process to back up log data to a different system or media than the system being audited has been implemented. + +If it has not, this is a finding. + + + <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify the audit records, at a minimum, are off-loaded for interconnected systems in real time and off-loaded for standalone systems weekly. + +If they are not, this is a finding. + + + <VulnDiscussion>The Windows Time Service controls time synchronization settings. Time synchronization is essential for authentication and auditing purposes. If the Windows Time Service is used, it must synchronize with a secure, authorized time source. Domain-joined systems are automatically configured to synchronize with domain controllers. If an NTP server is configured, it must synchronize with a secure, authorized time source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the Windows time service configuration. + +Open an elevated "Command Prompt" (run as administrator). + +Enter "W32tm /query /configuration". + +Domain-joined systems (excluding the domain controller with the PDC emulator role): + +If the value for "Type" under "NTP Client" is not "NT5DS", this is a finding. + +Other systems: + +If systems are configured with a "Type" of "NTP", including standalone systems and the domain controller with the PDC Emulator role, and do not have a DoD time server defined for "NTPServer", this is a finding. + +To determine the domain controller with the PDC Emulator role: + +Open "PowerShell". + +Enter "Get-ADDomain | FT PDCEmulator". + + + <VulnDiscussion>Monitoring system files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine whether the system is monitored for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis. + +If system files are not monitored for unauthorized changes, this is a finding. + +A properly configured HBSS Policy Auditor 5.2 or later File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement. + + + <VulnDiscussion>Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account. + +Since administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy require administrative accounts to not access the Internet or use applications such as email. + +The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. + +Whitelisting can be used to enforce the policy to ensure compliance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine whether organization policy, at a minimum, prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. + +If it does not, this is a finding. + +The organization may use technical means such as whitelisting to prevent the use of browsers and mail applications to enforce this requirement. + + + <VulnDiscussion>Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Members of the Backup Operators group must have separate logon accounts for performing backup duties.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If no accounts are members of the Backup Operators group, this is NA. + +Verify users with accounts in the Backup Operators group have a separate user account for backup functions and for performing normal user tasks. + +If users with accounts in the Backup Operators group do not have separate accounts for backup functions and standard user functions, this is a finding. + + + <VulnDiscussion>Setting application account passwords to expire may cause applications to stop functioning. However, not changing them on a regular basis exposes them to attack. If managed service accounts are used, this alleviates the need to manually change application account passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine if manually managed application/service accounts exist. If none exist, this is NA. + +If passwords for manually managed application/service accounts are not changed at least annually or when an administrator with knowledge of the password leaves the organization, this is a finding. + +Identify manually managed application/service accounts. + +To determine the date a password was last changed: + +Domain controllers: + +Open "PowerShell". + +Enter "Get-AdUser -Identity [application account name] -Properties PasswordLastSet | FT Name, PasswordLastSet", where [application account name] is the name of the manually managed application/service account. + +If the "PasswordLastSet" date is more than one year old, this is a finding. + + +Member servers and standalone systems: + +Open "Command Prompt". + +Enter 'Net User [application account name] | Find /i "Password Last Set"', where [application account name] is the name of the manually managed application/service account. + +If the "Password Last Set" date is more than one year old, this is a finding. + + + <VulnDiscussion>The krbtgt account acts as a service account for the Kerberos Key Distribution Center (KDC) service. The account and password are created when a domain is created and the password is typically not changed. If the krbtgt account is compromised, attackers can create valid Kerberos Ticket Granting Tickets (TGT). + +The password must be changed twice to effectively remove the password history. Changing once, waiting for replication to complete and changing again reduces the risk of issues. Changing twice in rapid succession forces clients to re-authenticate (including application services) but is desired if a compromise is suspected.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This requirement is applicable to domain controllers; it is NA for other systems. + +Open "Windows PowerShell". + +Enter "Get-ADUser krbtgt -Property PasswordLastSet". + +If the "PasswordLastSet" date is more than 180 days old, this is a finding. + + + <VulnDiscussion>Credential Guard uses virtualization-based security to protect data that could be used in credential theft attacks if compromised. A number of system requirements must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + For standalone systems, this is NA. + +Current hardware and virtual environments may not support virtualization-based security features, including Credential Guard, due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within a virtual machine. + +Verify the system has a TPM and it is ready for use. + +Run "tpm.msc". + +Review the sections in the center pane. + +"Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has been taken". + +TPM Manufacturer Information - Specific Version = 2.0 or 1.2 + +If a TPM is not found or is not ready for use, this is a finding. + + + <VulnDiscussion>The FTP service allows remote users to access shared files and directories. Allowing anonymous FTP connections makes user auditing difficult. + +Using accounts that have administrator privileges to log on to FTP risks that the userid and password will be captured on the network and give administrator access to an unauthorized user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If FTP is not installed on the system, this is NA. + +Open "Internet Information Services (IIS) Manager". + +Select the server. + +Double-click "FTP Authentication". + +If the "Anonymous Authentication" status is "Enabled", this is a finding. + + + <VulnDiscussion>The FTP service allows remote users to access shared files and directories that could provide access to system resources and compromise the system, especially if the user can gain access to the root directory of the boot drive.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If FTP is not installed on the system, this is NA. + +Open "Internet Information Services (IIS) Manager". + +Select "Sites" under the server name. + +For any sites with a Binding that lists FTP, right-click the site and select "Explore". + +If the site is not defined to a specific folder for shared FTP resources, this is a finding. + +If the site includes any system areas such as root of the drive, Program Files, or Windows directories, this is a finding. + + + <VulnDiscussion>UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in "Legacy BIOS" mode will not support these security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must run in "UEFI" mode. + +Verify the system firmware is configured to run in "UEFI" mode, not "Legacy BIOS". + +Run "System Information". + +Under "System Summary", if "BIOS Mode" does not display "UEFI", this is a finding. + + + <VulnDiscussion>Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled. + +Run "System Information". + +Under "System Summary", if "Secure Boot State" does not display "On", this is a finding. + +On server core installations, run the following PowerShell command: + +Confirm-SecureBootUEFI + +If a value of "True" is not returned, this is a finding. + + + <VulnDiscussion>To the extent that anonymous access to directory data (outside the root DSE) is permitted, read access control of the data is effectively disabled. If other means of controlling access (such as network restrictions) are compromised, there may be nothing else to protect the confidentiality of sensitive directory data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Open "Command Prompt" (not elevated). + +Run "ldp.exe". + +From the "Connection menu", select "Bind". + +Clear the User, Password, and Domain fields. + +Select "Simple bind" for the Bind type and click "OK". + +Confirmation of anonymous access will be displayed at the end: + +res = ldap_simple_bind_s +Authenticated as: 'NT AUTHORITY\ANONYMOUS LOGON' + +From the "Browse" menu, select "Search". + +In the Search dialog, enter the DN of the domain naming context (generally something like "dc=disaost,dc=mil") in the Base DN field. + +Clear the Attributes field and select "Run". + +Error messages should display related to Bind and user not authenticated. + +If attribute data is displayed, anonymous access is enabled to the domain naming context and this is a finding. + +The following network controls allow the finding severity to be downgraded to a CAT II since these measures lower the risk associated with anonymous access. + +Network hardware ports at the site are subject to 802.1x authentication or MAC address restrictions. + +Premise firewall or host restrictions prevent access to ports 389, 636, 3268, and 3269 from client hosts not explicitly identified by domain (.mil) or IP address. + + + <VulnDiscussion>Using a privileged account to perform routine functions makes the computer vulnerable to malicious software inadvertently introduced during a session that has been granted full privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify each user with administrative privileges has been assigned a unique administrative account separate from their standard user account. + +If users with administrative privileges do not have separate accounts for administrative functions and standard user functions, this is a finding. + + + <VulnDiscussion>Using a whitelist provides a configuration management method to allow the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. + +The organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This is applicable to unclassified systems. For other systems, this is NA. + +Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. + +If an application whitelisting program is not in use on the system, this is a finding. + +Configuration of whitelisting applications will vary by the program. + +AppLocker is a whitelisting application built into Windows Server. A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules. + +If AppLocker is used, perform the following to view the configuration of AppLocker: + +Open "PowerShell". + +If the AppLocker PowerShell module has not been imported previously, execute the following first: + +Import-Module AppLocker + +Execute the following command, substituting [c:\temp\file.xml] with a location and file name appropriate for the system: + +Get-AppLockerPolicy -Effective -XML > c:\temp\file.xml + +This will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review. + +Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link: + +https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm + + + <VulnDiscussion>Executing application servers on the same host machine with a directory server may substantially weaken the security of the directory server. Web or database server applications usually require the addition of many programs and accounts, increasing the attack surface of the computer. + +Some applications require the addition of privileged accounts, providing potential sources of compromise. Some applications (such as Microsoft Exchange) may require the use of network ports or services conflicting with the directory server. In this case, non-standard ports might be selected, and this could interfere with intrusion detection or prevention services.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers, it is NA for other systems. + +Review the installed roles the domain controller is supporting. + +Start "Server Manager". + +Select "AD DS" in the left pane and the server name under "Servers" to the right. + +Select "Add (or Remove) Roles and Features" from "Tasks" in the "Roles and Features" section. (Cancel before any changes are made.) + +Determine if any additional server roles are installed. A basic domain controller setup will include the following: + +- Active Directory Domain Services +- DNS Server +- File and Storage Services + +If any roles not requiring installation on a domain controller are installed, this is a finding. + +A Domain Name System (DNS) server integrated with the directory server (e.g., AD-integrated DNS) is an acceptable application. However, the DNS server must comply with the DNS STIG security requirements. + +Run "Programs and Features". + +Review installed applications. + +If any applications are installed that are not required for the domain controller, this is a finding. + + + <VulnDiscussion>The lack of password protection enables anyone to gain access to the information system, which opens a backdoor opportunity for intruders to compromise the system as well as other resources. Accounts on a system must require passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the password required status for enabled user accounts. + +Open "PowerShell". + +Domain Controllers: + +Enter "Get-Aduser -Filter * -Properties Passwordnotrequired |FT Name, Passwordnotrequired, Enabled". + +Exclude disabled accounts (e.g., DefaultAccount, Guest) and Trusted Domain Objects (TDOs). + +If "Passwordnotrequired" is "True" or blank for any enabled user account, this is a finding. + +Member servers and standalone systems: + +Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordRequired=False and LocalAccount=True" | FT Name, PasswordRequired, Disabled, LocalAccount'. + +Exclude disabled accounts (e.g., DefaultAccount, Guest). + +If any enabled user accounts are returned with a "PasswordRequired" status of "False", this is a finding. + + + <VulnDiscussion>Smart cards such as the CAC support a two-factor authentication technique. This provides a higher level of trust in the asserted identity than use of the username and password for authentication. + +Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055, SRG-OS-000375-GPOS-00160</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Open "PowerShell". + +Enter the following: + +"Get-ADUser -Filter {(Enabled -eq $True) -and (SmartcardLogonRequired -eq $False)} | FT Name" +("DistinguishedName" may be substituted for "Name" for more detailed output.) + +If any user accounts, including administrators, are listed, this is a finding. + + +Alternately: + +To view sample accounts in "Active Directory Users and Computers" (available from various menus or run "dsa.msc"): + +Select the Organizational Unit (OU) where the user accounts are located. (By default, this is the Users node; however, accounts may be under other organization-defined OUs.) + +Right-click the sample user account and select "Properties". + +Select the "Account" tab. + +If any user accounts, including administrators, do not have "Smart card is required for interactive logon" checked in the "Account Options" area, this is a finding. + + + <VulnDiscussion>Application/service account passwords must be of sufficient length to prevent being easily cracked. Application/service accounts that are manually managed must have passwords at least 15 characters in length.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine if manually managed application/service accounts exist. If none exist, this is NA. + +Verify the organization has a policy to ensure passwords for manually managed application/service accounts are at least 15 characters in length. + +If such a policy does not exist or has not been implemented, this is a finding. + + + <VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. The built-in Administrator account is not generally used and its password not may be changed as frequently as necessary. Changing the password for the built-in Administrator account on a regular basis will limit its exposure. + +Organizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every "30" days by default.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the password last set date for the built-in Administrator account. + +Domain controllers: + +Open "PowerShell". + +Enter "Get-ADUser -Filter * -Properties SID, PasswordLastSet | Where SID -Like "*-500" | Ft Name, SID, PasswordLastSet". + +If the "PasswordLastSet" date is greater than "60" days old, this is a finding. + +Member servers and standalone systems: + +Open "Command Prompt". + +Enter 'Net User [account name] | Find /i "Password Last Set"', where [account name] is the name of the built-in administrator account. + +(The name of the built-in Administrator account must be changed to something other than "Administrator" per STIG requirements.) + +If the "PasswordLastSet" date is greater than "60" days old, this is a finding. + + + <VulnDiscussion>Passwords that do not expire or are reused increase the exposure of a password with greater probability of being discovered or cracked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the password never expires status for enabled user accounts. + +Open "PowerShell". + +Domain Controllers: + +Enter "Search-ADAccount -PasswordNeverExpires -UsersOnly | FT Name, PasswordNeverExpires, Enabled". + +Exclude application accounts, disabled accounts (e.g., DefaultAccount, Guest) and the krbtgt account. + +If any enabled user accounts are returned with a "PasswordNeverExpires" status of "True", this is a finding. + +Member servers and standalone systems: + +Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordExpires=False and LocalAccount=True" | FT Name, PasswordExpires, Disabled, LocalAccount'. + +Exclude application accounts and disabled accounts (e.g., DefaultAccount, Guest). + +If any enabled user accounts are returned with a "PasswordExpires" status of "False", this is a finding. + + + <VulnDiscussion>Domain controllers are part of the chain of trust for PKI authentications. Without the appropriate certificate, the authenticity of the domain controller cannot be verified. Domain controllers must have a server certificate to establish authenticity as part of PKI authentications in the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Run "MMC". + +Select "Add/Remove Snap-in" from the "File" menu. + +Select "Certificates" in the left pane and click the "Add >" button. + +Select "Computer Account" and click "Next". + +Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish". + +Click "OK". + +Select and expand the Certificates (Local Computer) entry in the left pane. + +Select and expand the Personal entry in the left pane. + +Select the Certificates entry in the left pane. + +If no certificate for the domain controller exists in the right pane, this is a finding. + + + <VulnDiscussion>A PKI implementation depends on the practices established by the Certificate Authority (CA) to ensure the implementation is secure. Without proper practices, the certificates issued by a CA have limited value in authentication functions. The use of multiple CAs from separate PKI implementations results in interoperability issues. If servers and clients do not have a common set of root CA certificates, they are not able to authenticate each other.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Run "MMC". + +Select "Add/Remove Snap-in" from the "File" menu. + +Select "Certificates" in the left pane and click the "Add >" button. + +Select "Computer Account" and click "Next". + +Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish". + +Click "OK". + +Select and expand the Certificates (Local Computer) entry in the left pane. + +Select and expand the Personal entry in the left pane. + +Select the Certificates entry in the left pane. + +In the right pane, examine the "Issued By" field for the certificate to determine the issuing CA. + +If the "Issued By" field of the PKI certificate being used by the domain controller does not indicate the issuing CA is part of the DoD PKI or an approved ECA, this is a finding. + +If the certificates in use are issued by a CA authorized by the Component's CIO, this is a CAT II finding. + +There are multiple sources from which lists of valid DoD CAs and approved ECAs can be obtained: + +The Global Directory Service (GDS) website provides an online source. The address for this site is https://crl.gds.disa.mil. + +DoD Public Key Enablement (PKE) Engineering Support maintains the InstallRoot utility to manage DoD supported root certificates on Windows computers, which includes a list of authorized CAs. The utility package can be downloaded from the PKI and PKE Tools page on IASE: + +http://iase.disa.mil/pki-pke/function_pages/tools.html + + + <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. + +Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This is applicable to unclassified systems. It is NA for others. + +Open "PowerShell" as an administrator. + +Execute the following command: + +Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter + +If the following certificate "Subject", "Issuer", and "Thumbprint" information is not displayed, this is a finding. + +If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. + +Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F +NotAfter: 9/6/2019 + +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: FCE1B1E25374DD94F5935BEB86CA643D8C8D1FF4 +NotAfter: 2/17/2019 + +Alternately, use the Certificates MMC snap-in: + +Run "MMC". + +Select "File", "Add/Remove Snap-in". + +Select "Certificates" and click "Add". + +Select "Computer account" and click "Next". + +Select "Local computer: (the computer this console is running on)" and click "Finish". + +Click "OK". + +Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". + +For each certificate with "DoD Root CA..." under "Issued To" and "DoD Interoperability Root CA..." under "Issued By": + +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. + +Issued To: DoD Root CA 2 +Issued By: DoD Interoperability Root CA 1 +Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F +Valid to: Friday, September 6, 2019 + +Issued To: DoD Root CA 3 +Issued By: DoD Interoperability Root CA 2 +Thumbprint: FFAD03329B9E527A43EEC66A56F9CBB5393E6E13 +Valid to: Sunday, September 23, 2018 + +Issued To: DoD Root CA 3 +Issued By: DoD Interoperability Root CA 2 +Thumbprint: FCE1B1E25374DD94F5935BEB86CA643D8C8D1FF4 +Valid to: Sunday, February 17, 2019 + + + <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. + +Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This is applicable to unclassified systems. It is NA for others. + +Open "PowerShell" as an administrator. + +Execute the following command: + +Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter + +If the following certificate "Subject", "Issuer", and "Thumbprint" information is not displayed, this is a finding. + +If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. + +Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=US DoD CCEB Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: DA36FAF56B2F6FBA1604F5BE46D864C9FA013BA3 +NotAfter: 3/9/2019 + +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E +NotAfter: 9/27/2019 + +Alternately, use the Certificates MMC snap-in: + +Run "MMC". + +Select "File", "Add/Remove Snap-in". + +Select "Certificates" and click "Add". + +Select "Computer account" and click "Next". + +Select "Local computer: (the computer this console is running on)" and click "Finish". + +Click "OK". + +Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". + +For each certificate with "US DoD CCEB Interoperability Root CA ..." under "Issued By": + +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. + +Issued To: DoD Root CA 2 +Issued By: US DoD CCEB Interoperability Root CA 1 +Thumbprint: DA36FAF56B2F6FBA1604F5BE46D864C9FA013BA3 +Valid to: Saturday, March 9, 2019 + +Issued To: DoD Root CA 3 +Issuer by: US DoD CCEB Interoperability Root CA 2 +Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E +Valid: Friday, September 27, 2019 + + + <VulnDiscussion>The failure to terminate inactive network connections increases the risk of a successful attack on the directory server. The longer an established session is in progress, the more time an attacker has to hijack the session, implement a means to passively intercept data, or compromise any protections on client access. For example, if an attacker gains control of a client computer, an existing (already authenticated) session with the directory server could allow access to the directory. The lack of confidentiality protection in LDAP-based sessions increases exposure to this vulnerability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Open an elevated "Command Prompt" (run as administrator). + +Enter "ntdsutil". + +At the "ntdsutil:" prompt, enter "LDAP policies". + +At the "ldap policy:" prompt, enter "connections". + +At the "server connections:" prompt, enter "connect to server [host-name]" +(where [host-name] is the computer name of the domain controller). + +At the "server connections:" prompt, enter "q". + +At the "ldap policy:" prompt, enter "show values". + +If the value for MaxConnIdleTime is greater than "300" (5 minutes) or is not specified, this is a finding. + +Enter "q" at the "ldap policy:" and "ntdsutil:" prompts to exit. + +Alternately, Dsquery can be used to display MaxConnIdleTime: + +Open "Command Prompt (Admin)". +Enter the following command (on a single line). + +dsquery * "cn=Default Query Policy,cn=Query-Policies,cn=Directory Service, cn=Windows NT,cn=Services,cn=Configuration,dc=[forest-name]" -attr LDAPAdminLimits + +The quotes are required and dc=[forest-name] is the fully qualified LDAP name of the domain being reviewed (e.g., dc=disaost,dc=mil). + +If the results do not specify a "MaxConnIdleTime" or it has a value greater than "300" (5 minutes), this is a finding. + + + <VulnDiscussion>This requirement addresses protection of user-generated data as well as operating system-specific configuration data. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate, in accordance with the security category and/or classification of the information. + +Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields). + +Satisfies: SRG-OS-000185-GPOS-00079, SRG-OS-000404-GPOS-00183, SRG-OS-000405-GPOS-00184</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data employ encryption to protect the confidentiality and integrity of all information at rest. + +If they do not, this is a finding. + + + <VulnDiscussion>Shares on a system provide network access. To prevent exposing sensitive information, where shares are necessary, permissions must be reconfigured to give the minimum access to accounts that require it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If only system-created shares such as "ADMIN$", "C$", and "IPC$" exist on the system, this is NA. (System-created shares will display a message that it has been shared for administrative purposes when "Properties" is selected.) + +Run "Computer Management". + +Navigate to System Tools >> Shared Folders >> Shares. + +Right-click any non-system-created shares. + +Select "Properties". + +Select the "Share Permissions" tab. + +If the file shares have not been configured to restrict permissions to the specific groups or accounts that require access, this is a finding. + +Select the "Security" tab. + +If the permissions have not been configured to restrict permissions to the specific groups or accounts that require access, this is a finding. + + + <VulnDiscussion>When directory service data files, especially for directories used for identification, authentication, or authorization, reside on the same logical partition as user-owned files, the directory service data may be more vulnerable to unauthorized access or other availability compromises. Directory service and user-owned data files sharing a partition may be configured with less restrictive permissions in order to allow access to the user data. + +The directory service may be vulnerable to a denial of service attack when user-owned files on a common partition are expanded to an extent preventing the directory service from acquiring more space for directory or audit data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to domain controllers. It is NA for other systems. + +Run "Regedit". + +Navigate to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters". + +Note the directory locations in the values for "DSA Database file". + +Open "Command Prompt". + +Enter "net share". + +Note the logical drive(s) or file system partition for any organization-created data shares. + +Ignore system shares (e.g., NETLOGON, SYSVOL, and administrative shares ending in $). User shares that are hidden (ending with $) should not be ignored. + +If user shares are located on the same logical partition as the directory server data files, this is a finding. + + + <VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. + +Ensuring the confidentiality of transmitted information requires the operating system to take measures in preparing information for transmission. This can be accomplished via access control and encryption. + +Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, operating systems need to support transmission protection mechanisms such as TLS, encrypted VPNs, or IPsec. + +Satisfies: SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, verify protection methods such as TLS, encrypted VPNs, or IPsec have been implemented. + +If protection methods have not been implemented, this is a finding. + + + <VulnDiscussion>Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups. If the account or group objects are reanimated, there is a potential they may still have rights no longer intended. Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the effective User Rights setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format that begins with "*S-1-".) + +If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding. + + + + + + + + + + + SYSTEM + False + This folder subfolders and files + FullControl + + + + + Administrators + False + This folder subfolders and files + FullControl + + + + + Users + False + This folder subfolders and files + ReadAndExecute + + + + + Users + False + This folder and subfolders + CreateDirectories,AppendData + + + + + Users + False + Subfolders only + CreateFiles,WriteData + + + + + CREATOR OWNER + False + Subfolders and files only + FullControl + + + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + +The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %SystemDrive%\ + The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Review the permissions for the system drive's root directory (usually C:\). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions except where noted as defaults. Individual accounts must not be used to assign permissions. + +If permissions are not as restrictive as the default permissions listed below, this is a finding. + +Viewing in File Explorer: + +View the Properties of the system drive's root directory. + +Select the "Security" tab, and the "Advanced" button. + +Default permissions: +C:\ +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +SYSTEM - Full control - This folder, subfolders, and files +Administrators - Full control - This folder, subfolders, and files +Users - Read & execute - This folder, subfolders, and files +Users - Create folders/append data - This folder and subfolders +Users - Create files/write data - Subfolders only +CREATOR OWNER - Full Control - Subfolders and files only + +Alternately, use icacls: + +Open "Command Prompt (Admin)". + +Enter "icacls" followed by the directory: + +"icacls c:\" + +The following results should be displayed: + +c:\ +NT AUTHORITY\SYSTEM:(OI)(CI)(F) +BUILTIN\Administrators:(OI)(CI)(F) +BUILTIN\Users:(OI)(CI)(RX) +BUILTIN\Users:(CI)(AD) +BUILTIN\Users:(CI)(IO)(WD) +CREATOR OWNER:(OI)(CI)(IO)(F) +Successfully processed 1 files; Failed processing 0 files + + + + + + + TrustedInstaller + False + This folder and subfolders + FullControl + + + + + SYSTEM + False + This folder only + Modify + + + + + SYSTEM + False + Subfolders and files only + FullControl + + + + + Administrators + False + This folder only + Modify + + + + + Administrators + False + Subfolders and files only + FullControl + + + + + Users + False + This folder subfolders and files + ReadAndExecute + + + + + CREATOR OWNER + False + Subfolders and files only + FullControl + + + + + ALL APPLICATION PACKAGES + False + This folder subfolders and files + ReadAndExecute + + + + + ALL RESTRICTED APPLICATION PACKAGES + False + This folder subfolders and files + ReadAndExecute + + + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + +The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %ProgramFiles(x86)% + The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). +Review the permissions for the program file directories (Program Files and Program Files [x86]). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. Individual accounts must not be used to assign permissions. +If permissions are not as restrictive as the default permissions listed below, this is a finding. +Viewing in File Explorer: +For each folder, view the Properties. +Select the "Security" tab, and the "Advanced" button. +Default permissions: +\Program Files (x86) +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +Alternately, use icacls: +Open a Command prompt (admin). +Enter "icacls" followed by the directory: +'icacls "c:\program files"' +'icacls "c:\program files (x86)"' +The following results should be displayed for each when entered: +c:\program files (c:\program files (x86)) +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 files + + + + + + + + TrustedInstaller + False + This folder and subfolders + FullControl + + + + + SYSTEM + False + This folder only + Modify + + + + + SYSTEM + False + Subfolders and files only + FullControl + + + + + Administrators + False + This folder only + Modify + + + + + Administrators + False + Subfolders and files only + FullControl + + + + + Users + False + This folder subfolders and files + ReadAndExecute + + + + + CREATOR OWNER + False + Subfolders and files only + FullControl + + + + + ALL APPLICATION PACKAGES + False + This folder subfolders and files + ReadAndExecute + + + + + ALL RESTRICTED APPLICATION PACKAGES + False + This folder subfolders and files + ReadAndExecute + + + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + +The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %ProgramFiles% + The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). +Review the permissions for the program file directories (Program Files and Program Files [x86]). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. Individual accounts must not be used to assign permissions. +If permissions are not as restrictive as the default permissions listed below, this is a finding. +Viewing in File Explorer: +For each folder, view the Properties. +Select the "Security" tab, and the "Advanced" button. +Default permissions: +\Program Files +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +Alternately, use icacls: +Open a Command prompt (admin). +Enter "icacls" followed by the directory: +'icacls "c:\program files"' +'icacls "c:\program files (x86)"' +The following results should be displayed for each when entered: +c:\program files (c:\program files (x86)) +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 files + + + + + + + + TrustedInstaller + False + This folder and subfolders + FullControl + + + + + SYSTEM + False + This folder only + Modify + + + + + SYSTEM + False + Subfolders and files only + FullControl + + + + + Administrators + False + This folder only + Modify + + + + + Administrators + False + Subfolders and files only + FullControl + + + + + Users + False + This folder subfolders and files + ReadAndExecute + + + + + CREATOR OWNER + False + Subfolders and files only + FullControl + + + + + ALL APPLICATION PACKAGES + False + This folder subfolders and files + ReadAndExecute + + + + + ALL RESTRICTED APPLICATION PACKAGES + False + This folder subfolders and files + ReadAndExecute + + + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + +The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %windir% + The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Review the permissions for the Windows installation directory (usually C:\Windows). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. Individual accounts must not be used to assign permissions. + +If permissions are not as restrictive as the default permissions listed below, this is a finding: + +Viewing in File Explorer: + +For each folder, view the Properties. + +Select the "Security" tab and the "Advanced" button. + +Default permissions: +\Windows +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders, and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files + +Alternately, use icacls: + +Open a Command prompt (admin). + +Enter "icacls" followed by the directory: + +"icacls c:\windows" + +The following results should be displayed for each when entered: + +c:\windows +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 files + + + + + + + SYSTEM + False + This Key and Subkeys + FullControl + + + <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + HKLM:\SECURITY + Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. +If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. +If permissions are not as restrictive as the default permissions listed below, this is a finding: +Run "Regedit". +Right-click on the registry areas noted below. +Select "Permissions" and the "Advanced" button. +HKEY_LOCAL_MACHINE\SECURITY +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +SYSTEM - Full Control - This key and subkeys +Administrators - Special - This key and subkeys +Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. +Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in Windows Server 2019 to the following SID, this is currently not a finding. +S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681 +If the defaults have not been changed, these are not a finding. + + + + + + + + Users + False + This Key and Subkeys + ReadKey + + + + + Administrators + False + This Key and Subkeys + FullControl + + + + + SYSTEM + False + This Key and Subkeys + FullControl + + + + + CREATOR OWNER + False + This Key and Subkeys + FullControl + + + + + ALL APPLICATION PACKAGES + False + This Key and Subkeys + ReadKey + + + <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + HKLM:\SOFTWARE + Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. +If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. +If permissions are not as restrictive as the default permissions listed below, this is a finding: +Run "Regedit". +Right-click on the registry areas noted below. +Select "Permissions" and the "Advanced" button. +HKEY_LOCAL_MACHINE\SOFTWARE +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +Users - Read - This key and subkeys +Administrators - Full Control - This key and subkeys +SYSTEM - Full Control - This key and subkeys +CREATOR OWNER - Full Control - This key and subkeys +ALL APPLICATION PACKAGES - Read - This key and subkeys +Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. +Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in Windows Server 2019 to the following SID, this is currently not a finding. +S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681 +If the defaults have not been changed, these are not a finding. + + + + + + + + Users + False + This Key and Subkeys + ReadKey + + + + + Administrators + False + This Key and Subkeys + FullControl + + + + + SYSTEM + False + This Key and Subkeys + FullControl + + + + + CREATOR OWNER + False + Subkeys Only + FullControl + + + + + ALL APPLICATION PACKAGES + False + This Key and Subkeys + ReadKey + + + <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + HKLM:\SYSTEM + Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. +If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. +If permissions are not as restrictive as the default permissions listed below, this is a finding: +Run "Regedit". +Right-click on the registry areas noted below. +Select "Permissions" and the "Advanced" button. +HKEY_LOCAL_MACHINE\SYSTEM +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +Users - Read - This key and subkeys +Administrators - Full Control - This key and subkeys +SYSTEM - Full Control - This key and subkeys +CREATOR OWNER - Full Control - Subkeys only +ALL APPLICATION PACKAGES - Read - This key and subkeys +Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. +Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in Windows Server 2019 to the following SID, this is currently not a finding. +S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681 +If the defaults have not been changed, these are not a finding. + + + + + + + + Authenticated Users + False + This folder subfolders and files + ReadAndExecute + + + + + Server Operators + False + This folder subfolders and files + ReadAndExecute + + + + + Administrators + False + This folder only + AppendData,ChangePermissions,CreateDirectories,CreateFiles,Delete,DeleteSubdirectoriesAndFiles,ExecuteFile,ListDirectory,Modify,Read,ReadAndExecute,ReadAttributes,ReadData,ReadExtendedAttributes,ReadPermissions,Synchronize,TakeOwnership,Traverse,Write,WriteAttributes,WriteData,WriteExtendedAttributes + + + + + CREATOR OWNER + False + Subfolders and files only + FullControl + + + + + Administrators + False + Subfolders and files only + FullControl + + + + + SYSTEM + False + This folder subfolders and files + FullControl + + + <VulnDiscussion>Improper access permissions for directory data files could allow unauthorized users to read, modify, or delete directory data. + +The SYSVOL directory contains public files (to the domain) such as policies and logon scripts. Data in shared subdirectories are replicated to all domain controllers in a domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %windir%\sysvol + This applies to domain controllers. It is NA for other systems. + +Open a command prompt. + +Run "net share". + +Make note of the directory location of the SYSVOL share. + +By default, this will be \Windows\SYSVOL\sysvol. For this requirement, permissions will be verified at the first SYSVOL directory level. + +If any standard user accounts or groups have greater than "Read & execute" permissions, this is a finding. + +The default permissions noted below meet this requirement: + +Open "Command Prompt". + +Run "icacls c:\Windows\SYSVOL". + +The following results should be displayed: + +NT AUTHORITY\Authenticated Users:(RX) +NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(GR,GE) +BUILTIN\Server Operators:(RX) +BUILTIN\Server Operators:(OI)(CI)(IO)(GR,GE) +BUILTIN\Administrators:(M,WDAC,WO) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(F) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +CREATOR OWNER:(OI)(CI)(IO)(F) + +(RX) - Read & execute + +Run "icacls /help" to view definitions of other permission codes. + +Alternately, open "File Explorer". + +Navigate to \Windows\SYSVOL (or the directory noted previously if different). + +Right-click the directory and select properties. + +Select the "Security" tab and click "Advanced". + +Default permissions: + +C:\Windows\SYSVOL +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +Authenticated Users - Read & execute- This folder, subfolder, and files +Server Operators - Read & execute- This folder, subfolder, and files +Administrators - Special - This folder only (Special = Basic Permissions: all selected except Full control) +CREATOR OWNER - Full control - Subfolders and files only +Administrators - Full control - Subfolders and files only +SYSTEM - Full control - This folder, subfolders, and files + + + + + + + Eventlog + False + + + FullControl + + + + + SYSTEM + False + + + FullControl + + + + + Administrators + False + + + FullControl + + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Application event log may be susceptible to tampering if proper permissions are not applied. + +Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %windir%\SYSTEM32\WINEVT\LOGS\Application.evtx + Navigate to the Application event log file. + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. + +If the permissions for the "Application.evtx" file are not as restrictive as the default permissions listed below, this is a finding: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + + + + + + + Eventlog + False + + + FullControl + + + + + SYSTEM + False + + + FullControl + + + + + Administrators + False + + + FullControl + + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Security event log may disclose sensitive information or be susceptible to tampering if proper permissions are not applied. + +Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %windir%\SYSTEM32\WINEVT\LOGS\Security.evtx + Navigate to the Security event log file. + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. + +If the permissions for the "Security.evtx" file are not as restrictive as the default permissions listed below, this is a finding: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + + + + + + + Eventlog + False + + + FullControl + + + + + SYSTEM + False + + + FullControl + + + + + Administrators + False + + + FullControl + + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The System event log may be susceptible to tampering if proper permissions are not applied. + +Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %windir%\SYSTEM32\WINEVT\LOGS\System.evtx + Navigate to the System event log file. + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. + +If the permissions for the "System.evtx" file are not as restrictive as the default permissions listed below, this is a finding: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + + + + + + + TrustedInstaller + False + + + FullControl + + + + + Administrators + False + + + ReadAndExecute + + + + + SYSTEM + False + + + ReadAndExecute + + + + + Users + False + + + ReadAndExecute + + + + + ALL APPLICATION PACKAGES + False + + + ReadAndExecute + + + + + ALL RESTRICTED APPLICATION PACKAGES + False + + + ReadAndExecute + + + <VulnDiscussion>Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. + +Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order to make access decisions regarding the modification or deletion of audit tools. + +Satisfies: SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %windir%\SYSTEM32\eventvwr.exe + Navigate to "%SystemRoot%\System32". + +View the permissions on "Eventvwr.exe". + +If any groups or accounts other than TrustedInstaller have "Full control" or "Modify" permissions, this is a finding. + +The default permissions below satisfy this requirement: + +TrustedInstaller - Full Control +Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES, ALL RESTRICTED APPLICATION PACKAGES - Read & Execute + + + + + <VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Data Execution Prevention (DEP)", are enabled by default at the system level. DEP prevents code from being run from data-only memory pages. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP + False + System + False + + This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "DEP: Enable" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration) + + + <VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Control flow guard (CFG)", are enabled by default at the system level. CFG ensures flow integrity for indirect calls. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + CFG + False + System + False + + This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "CFG: Enable" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration) + + + <VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Validate exception chains (SEHOP)", are enabled by default at the system level. SEHOP (structured exception handling overwrite protection) ensures the integrity of an exception chain during exception dispatch. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + SEHOP + False + System + False + + This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "SEHOP: Enable" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration) + + + <VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Validate heap integrity", are enabled by default at the system level. "Validate heap integrity" terminates a process when heap corruption is detected. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + TerminateOnError + False + System + False + + This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "Heap: TerminateOnError" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration) + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,BottomUp,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + Acrobat.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name Acrobat.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,BottomUp,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + AcroRd32.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name AcroRd32.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP + False + chrome.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name chrome.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + EXCEL.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name EXCEL.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,BottomUp,ForceRelocateImages + False + firefox.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name firefox.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,BlockRemoteImageLoads,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec,DisallowChildProcessCreation + False + FLTLDR.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name FLTLDR.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Child Process: +DisallowChildProcessCreation: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,BlockRemoteImageLoads,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec,DisallowChildProcessCreation + False + GROOVE.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name GROOVE.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Child Process: +DisallowChildProcessCreation: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,BottomUp,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + iexplore.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name iexplore.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + INFOPATH.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name INFOPATH.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + java.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name [application name]" with each of the following substituted for [application name]: +java.exe, javaw.exe, and javaws.exe +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON" for each, this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + javaw.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name [application name]" with each of the following substituted for [application name]: +java.exe, javaw.exe, and javaws.exe +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON" for each, this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + javaws.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name [application name]" with each of the following substituted for [application name]: +java.exe, javaw.exe, and javaws.exe +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON" for each, this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + lync.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name lync.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + MSACCESS.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name MSACCESS.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + MSPUB.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name MSPUB.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + OIS.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name OIS.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,BlockRemoteImageLoads,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + OneDrive.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name OneDrive.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + OUTLOOK.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name OUTLOOK.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + plugin-container.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name plugin-container.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + POWERPNT.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name POWERPNT.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + PPTVIEW.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name PPTVIEW.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + VISIO.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name VISIO.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + VPREVIEW.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name VPREVIEW.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + WINWORD.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name WINWORD.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + wmplayer.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name wmplayer.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +Payload: +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + wordpad.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name wordpad.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Randomize memory allocations (Bottom-Up ASLR)", are enabled by default at the system level. Bottom-Up ASLR (address space layout randomization) randomizes locations for virtual memory allocations, including those for system structures. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + BottomUp + False + System + False + + This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "ASLR: BottomUp" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration) + + + + + <VulnDiscussion>Unattended systems are susceptible to unauthorized use and should be locked when unattended. The screen saver should be set at a maximum of 15 minutes and be password protected. This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer. + +Satisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + True + '{0}' -le '900' -and '{0}' -gt '0' + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: InactivityTimeoutSecs + +Value Type: REG_DWORD +Value: 0x00000384 (900) (or less, excluding "0" which is effectively disabled) + + InactivityTimeoutSecs + Dword + + + <VulnDiscussion>Allowing unsecure RPC communication exposes the system to man-in-the-middle attacks and data disclosure attacks. A man-in-the-middle attack occurs when an intruder captures packets between a client and server and modifies them before allowing the packets to be exchanged. Usually the attacker will modify the information in the packets in an attempt to cause either the client or server to reveal sensitive information. + +Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000250-GPOS-00093</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fEncryptRPCTraffic + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + fEncryptRPCTraffic + Dword + + + <VulnDiscussion>Remote connections must be encrypted to prevent interception of data or sensitive information. Selecting "High Level" will ensure encryption of Remote Desktop Services sessions in both directions. + +Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000250-GPOS-00093</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: MinEncryptionLevel + +Type: REG_DWORD +Value: 0x00000003 (3) + 3 + MinEncryptionLevel + Dword + + + <VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. + +Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: LegalNoticeText + +Value Type: REG_SZ +Value: See message text below + +You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. + +By using this IS (which includes any device attached to this IS), you consent to the following conditions: + +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. + +-At any time, the USG may inspect and seize data stored on this IS. + +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. + +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. + +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. + You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. + +By using this IS (which includes any device attached to this IS), you consent to the following conditions: + +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. + +-At any time, the USG may inspect and seize data stored on this IS. + +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. + +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. + +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. + LegalNoticeText + String + + + <VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. + +Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + True + '{0}' -match '^(DoD Notice and Consent Banner|US Department of Defense Warning Statement)$' + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: LegalNoticeCaption + +Value Type: REG_SZ +Value: See message title options below + +"DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or an organization-defined equivalent. + +If an organization-defined title is used, it can in no case contravene or modify the language of the banner text required in WN19-SO-000150. + +Automated tools may only search for the titles defined above. If an organization-defined title is used, a manual review will be required. + + LegalNoticeCaption + String + + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. +This setting allows administrators to enable more precise auditing capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: SCENoApplyLegacyAuditPolicy + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + SCENoApplyLegacyAuditPolicy + Dword + + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Enabling "Include command line data for process creation events" will record the command line information with the process creation events in the log. This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ + +Value Name: ProcessCreationIncludeCmdLine_Enabled + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + ProcessCreationIncludeCmdLine_Enabled + Dword + + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Enabling PowerShell script block logging will record detailed information from the processing of PowerShell commands and scripts. This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ + +Value Name: EnableScriptBlockLogging + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + EnableScriptBlockLogging + Dword + + + <VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application + True + '{0}' -ge '32768' + If the system is configured to write events directly to an audit server, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Application\ + +Value Name: MaxSize + +Type: REG_DWORD +Value: 0x00008000 (32768) (or greater) + + MaxSize + Dword + + + <VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security + True + '{0}' -ge '196608' + If the system is configured to write events directly to an audit server, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Security\ + +Value Name: MaxSize + +Type: REG_DWORD +Value: 0x00030000 (196608) (or greater) + + MaxSize + Dword + + + <VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\System + True + '{0}' -ge '32768' + If the system is configured to write events directly to an audit server, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\System\ + +Value Name: MaxSize + +Type: REG_DWORD +Value: 0x00008000 (32768) (or greater) + + MaxSize + Dword + + + <VulnDiscussion>Installation options for applications are typically controlled by administrators. This setting prevents users from changing installation options that may bypass security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ + +Value Name: EnableUserControl + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + EnableUserControl + Dword + + + <VulnDiscussion>Standard user accounts must not be granted elevated privileges. Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ + +Value Name: AlwaysInstallElevated + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AlwaysInstallElevated + Dword + + + <VulnDiscussion>Configuring the system to disable IPv6 source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ + +Value Name: DisableIPSourceRouting + +Type: REG_DWORD +Value: 0x00000002 (2) + 2 + DisableIPSourceRouting + Dword + + + <VulnDiscussion>Configuring the system to disable IP source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ + +Value Name: DisableIPSourceRouting + +Value Type: REG_DWORD +Value: 0x00000002 (2) + 2 + DisableIPSourceRouting + Dword + + + <VulnDiscussion>Allowing ICMP redirect of routes can lead to traffic not being routed properly. When disabled, this forces ICMP to be routed via the shortest path first.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ + +Value Name: EnableICMPRedirect + +Value Type: REG_DWORD +Value: 0x00000000 (0) + 0 + EnableICMPRedirect + Dword + + + <VulnDiscussion>Insecure guest logons allow unauthenticated access to shared folders. Shared resources on a system must require authentication to establish proper access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation\ + +Value Name: AllowInsecureGuestAuth + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AllowInsecureGuestAuth + Dword + + + <VulnDiscussion>Additional security requirements are applied to UNC paths specified in hardened UNC paths before allowing access to them. This aids in preventing tampering with or spoofing of connections to these paths.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\ +Value Type: REG_SZ +Value Name: \\*\NETLOGON +Value: RequireMutualAuthentication=1, RequireIntegrity=1 + RequireMutualAuthentication=1, RequireIntegrity=1 + \\*\NETLOGON + String + + + <VulnDiscussion>Additional security requirements are applied to UNC paths specified in hardened UNC paths before allowing access to them. This aids in preventing tampering with or spoofing of connections to these paths.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\ +Value Type: REG_SZ +Value Name: \\*\SYSVOL +Value: RequireMutualAuthentication=1, RequireIntegrity=1 + RequireMutualAuthentication=1, RequireIntegrity=1 + \\*\SYSVOL + String + + + <VulnDiscussion>An exportable version of credentials is provided to remote hosts when using credential delegation which exposes them to theft on the remote host. Restricted Admin mode or Remote Credential Guard allow delegation of non-exportable credentials providing additional protection of the credentials. Enabling this configures the host to support Restricted Admin mode or Remote Credential Guard.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\ + +Value Name: AllowProtectedCreds + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + AllowProtectedCreds + Dword + + + <VulnDiscussion>Virtualization Based Security (VBS) provides the platform for the additional security features Credential Guard and virtualization-based protection of code integrity. Secure Boot is the minimum security level, with DMA protection providing additional memory protection. DMA Protection requires a CPU that supports input/output memory management unit (IOMMU).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ +Value Type: REG_DWORD +Value Name: EnableVirtualizationBasedSecurity +Value: 0x00000001 (1) + 1 + EnableVirtualizationBasedSecurity + Dword + + + <VulnDiscussion>Virtualization Based Security (VBS) provides the platform for the additional security features Credential Guard and virtualization-based protection of code integrity. Secure Boot is the minimum security level, with DMA protection providing additional memory protection. DMA Protection requires a CPU that supports input/output memory management unit (IOMMU).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard + True + '{0}' -match '1|3' + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ +Value Type: REG_DWORD +Value Name: RequirePlatformSecurityFeatures +Value: 0x00000001 (1) (Secure Boot only) or 0x00000003 (3) (Secure Boot and DMA Protection) + + RequirePlatformSecurityFeatures + Dword + + + <VulnDiscussion>Compromised boot drivers can introduce malware prior to protection mechanisms that load after initialization. The Early Launch Antimalware driver can limit allowed drivers based on classifications determined by the malware protection application. At a minimum, drivers determined to be bad must not be allowed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\EarlyLaunch + True + '{0}' -match '1|3|8|ShouldBeAbsent' + The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy to enforce "Good, unknown and bad but critical" (preventing "bad"). + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0x00000007 (7)", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Policies\EarlyLaunch\ + +Value Name: DriverLoadPolicy + +Value Type: REG_DWORD +Value: 0x00000001 (1), 0x00000003 (3), or 0x00000008 (8) (or if the Value Name does not exist) + +Possible values for this setting are: +8 - Good only +1 - Good and unknown +3 - Good, unknown and bad but critical +7 - All (which includes "bad" and would be a finding) + + DriverLoadPolicy + Dword + + + <VulnDiscussion>Registry entries for group policy settings can potentially be changed from the required configuration. This could occur as part of troubleshooting or by a malicious process on a compromised system. Enabling this setting and then selecting the "Process even if the Group Policy objects have not changed" option ensures the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2} + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\ + +Value Name: NoGPOListChanges + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + NoGPOListChanges + Dword + + + <VulnDiscussion>A system that does not require authentication when resuming from sleep may provide access to unauthorized users. Authentication must always be required when accessing a system. This setting ensures users are prompted for a password when the system wakes from sleep (on battery).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51 + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ + +Value Name: DCSettingIndex + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DCSettingIndex + Dword + + + <VulnDiscussion>A system that does not require authentication when resuming from sleep may provide access to unauthorized users. Authentication must always be required when accessing a system. This setting ensures users are prompted for a password when the system wakes from sleep (plugged in).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51 + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ + +Value Name: ACSettingIndex + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + ACSettingIndex + Dword + + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information from being sent outside the enterprise. The "Security" option for Telemetry configures the lowest amount of data, effectively none outside of the Malicious Software Removal Tool (MSRT), Defender, and telemetry client settings. "Basic" sends basic diagnostic and usage data and may be required to support some Microsoft services.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection + True + '{0}' -match '0|1' + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DataCollection\ + +Value Name: AllowTelemetry + +Type: REG_DWORD +Value: 0x00000000 (0) (Security), 0x00000001 (1) (Basic) + + AllowTelemetry + Dword + + + <VulnDiscussion>Windows Update can obtain updates from additional sources instead of Microsoft. In addition to Microsoft, updates can be obtained from and sent to PCs on the local network as well as on the Internet. This is part of the Windows Update trusted process, however to minimize outside exposure, obtaining updates from or sending to systems on the Internet must be prevented.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization + True + '{0}' -match '0|1|2|99|100' + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\ + +Value Name: DODownloadMode + +Value Type: REG_DWORD +Value: 0x00000000 (0) - No peering (HTTP Only) +0x00000001 (1) - Peers on same NAT only (LAN) +0x00000002 (2) - Local Network / Private group peering (Group) +0x00000063 (99) - Simple download mode, no peering (Simple) +0x00000064 (100) - Bypass mode, Delivery Optimization not used (Bypass) + +A value of 0x00000003 (3), Internet, is a finding. + + DODownloadMode + Dword + + + <VulnDiscussion>Legacy plug-in applications may continue to function when a File Explorer session has become corrupt. Disabling this feature will prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer + False + + The default behavior is for File Explorer heap termination on corruption to be enabled. + +If the registry Value Name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0x00000000 (0) (or if the Value Name does not exist)", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ + +Value Name: NoHeapTerminationOnCorruption + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist) + 0 + NoHeapTerminationOnCorruption + Dword + + + <VulnDiscussion>The shell protocol will limit the set of folders that applications can open when run in protected mode. Restricting files an application can open to a limited set of folders increases the security of Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + False + + The default behavior is for shell protected mode to be turned on for File Explorer. + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0x00000000 (0) (or if the Value Name does not exist)", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ + +Value Name: PreXPSP2ShellProtocolBehavior + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist) + 0 + PreXPSP2ShellProtocolBehavior + Dword + + + <VulnDiscussion>Attachments from RSS feeds may not be secure. This setting will prevent attachments from being downloaded from RSS feeds.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds\ + +Value Name: DisableEnclosureDownload + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DisableEnclosureDownload + Dword + + + <VulnDiscussion>Web-based programs may attempt to install malicious software on a system. Ensuring users are notified if a web-based program attempts to install software allows them to refuse the installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer + False + + The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system. + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0x00000000 (0) (or if the Value Name does not exist)", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ + +Value Name: SafeForScripting + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist) + 0 + SafeForScripting + Dword + + + <VulnDiscussion>Windows can be configured to automatically sign the user back in after a Windows Update restart. Some protections are in place to help ensure this is done in a secure fashion; however, disabling this will prevent the caching of credentials for this purpose and also ensure the user is aware of the restart.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: DisableAutomaticRestartSignOn + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DisableAutomaticRestartSignOn + Dword + + + <VulnDiscussion>Enabling this setting on all domain controllers in a domain prevents domain members from changing their computer account passwords. If these passwords are weak or compromised, the inability to change them may leave these computers vulnerable.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + False + + This applies to domain controllers. It is NA for other systems. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: RefusePasswordChange + +Value Type: REG_DWORD +Value: 0x00000000 (0) + 0 + RefusePasswordChange + Dword + + + <VulnDiscussion>An account without a password can allow unauthorized access to a system as only the username would be required. Password policies should prevent accounts with blank passwords from existing on a system. However, if a local account with a blank password does exist, enabling this setting will prevent network access, limiting the account to local console logon only.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: LimitBlankPasswordUse + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + LimitBlankPasswordUse + Dword + + + <VulnDiscussion>Computer account passwords are changed automatically on a regular basis. This setting controls the maximum password age that a machine account may have. This must be set to no more than 30 days, ensuring the machine changes its password monthly.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + True + '{0}' -le '30' -and '{0}' -gt '0' + This is the default configuration for this setting (30 days). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: MaximumPasswordAge + +Value Type: REG_DWORD +Value: 0x0000001e (30) (or less, but not 0) + + MaximumPasswordAge + Dword + + + <VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked. Configuring a system to lock when a smart card is removed will ensure the system is inaccessible when unattended.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon + True + '{0}' -match '1|2' + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ + +Value Name: scremoveoption + +Value Type: REG_SZ +Value: 1 (Lock Workstation) or 2 (Force Logoff) + +If configuring this on servers causes issues, such as terminating users' remote sessions, and the organization has a policy in place that any other sessions on the servers, such as administrative console logons, are manually locked or logged off when unattended or not in use, this would be acceptable. This must be documented with the ISSO. + + scremoveoption + String + + + <VulnDiscussion>Anonymous enumeration of SAM accounts allows anonymous logon users (null session connections) to list all accounts names, thus providing a list of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: RestrictAnonymousSAM + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + RestrictAnonymousSAM + Dword + + + <VulnDiscussion>Access by anonymous users must be restricted. If this setting is enabled, anonymous users have the same rights and permissions as the built-in Everyone group. Anonymous users must not have these permissions or rights.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: EveryoneIncludesAnonymous + +Value Type: REG_DWORD +Value: 0x00000000 (0) + 0 + EveryoneIncludesAnonymous + Dword + + + <VulnDiscussion>Services using Local System that use Negotiate when reverting to NTLM authentication may gain unauthorized access if allowed to authenticate anonymously versus using the computer identity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\ + +Value Name: UseMachineId + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + UseMachineId + Dword + + + <VulnDiscussion>NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\MSV1_0 + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\MSV1_0\ + +Value Name: allownullsessionfallback + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + allownullsessionfallback + Dword + + + <VulnDiscussion>PKU2U is a peer-to-peer authentication protocol. This setting prevents online identities from authenticating to domain-joined systems. Authentication will be centrally managed with Windows user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\pku2u + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\pku2u\ + +Value Name: AllowOnlineID + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AllowOnlineID + Dword + + + <VulnDiscussion>The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts. NTLM, which is less secure, is retained in later Windows versions for compatibility with clients and servers that are running earlier versions of Windows or applications that still use it. It is also used to authenticate logons to standalone computers that are running later versions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: LmCompatibilityLevel + +Value Type: REG_DWORD +Value: 0x00000005 (5) + 5 + LmCompatibilityLevel + Dword + + + <VulnDiscussion>This setting controls the signing requirements for LDAP clients. This must be set to "Negotiate signing" or "Require signing", depending on the environment and type of LDAP server in use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LDAP + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LDAP\ + +Value Name: LDAPClientIntegrity + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + LDAPClientIntegrity + Dword + + + <VulnDiscussion>Microsoft has implemented a variety of security support providers for use with Remote Procedure Call (RPC) sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ + +Value Name: NTLMMinClientSec + +Value Type: REG_DWORD +Value: 0x20080000 (537395200) + 537395200 + NTLMMinClientSec + Dword + + + <VulnDiscussion>Microsoft has implemented a variety of security support providers for use with Remote Procedure Call (RPC) sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ + +Value Name: NTLMMinServerSec + +Value Type: REG_DWORD +Value: 0x20080000 (537395200) + 537395200 + NTLMMinServerSec + Dword + + + <VulnDiscussion>Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default Discretionary Access Control List (DACL) that specifies who can access the objects with what permissions. When this policy is enabled, the default DACL is stronger, allowing non-administrative users to read shared objects but not to modify shared objects they did not create.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\ + +Value Name: ProtectionMode + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + ProtectionMode + Dword + + + <VulnDiscussion>Attachments from outside sources may contain malicious code. Preserving zone of origin (Internet, intranet, local, restricted) information on file attachments allows Windows to determine risk.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments + False + + The default behavior is for Windows to mark file attachments with their zone information. + +If the registry Value Name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0x00000002 (2) (or if the Value Name does not exist)", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\ + +Value Name: SaveZoneInformation + +Value Type: REG_DWORD +Value: 0x00000002 (2) (or if the Value Name does not exist) + 2 + SaveZoneInformation + Dword + + + <VulnDiscussion>Allowing AutoPlay to execute may introduce malicious code to a system. AutoPlay begins reading from a drive as soon as media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. This setting will disable AutoPlay for non-volume devices, such as Media Transfer Protocol (MTP) devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ + +Value Name: NoAutoplayfornonVolume + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + NoAutoplayfornonVolume + Dword + + + <VulnDiscussion>Allowing AutoRun commands to execute may introduce malicious code to a system. Configuring this setting prevents AutoRun commands from executing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ + +Value Name: NoAutorun + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + NoAutorun + Dword + + + <VulnDiscussion>Allowing AutoPlay to execute may introduce malicious code to a system. AutoPlay begins reading from a drive as soon media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. By default, AutoPlay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive) and on network drives. Enabling this policy disables AutoPlay on all drives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ + +Value Name: NoDriveTypeAutoRun + +Type: REG_DWORD +Value: 0x000000ff (255) + 255 + NoDriveTypeAutoRun + Dword + + + <VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters + False + + Different methods are available to disable SMBv1 on Windows Server 2019, if WN19-00-000380 is configured, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\ + +Value Name: SMB1 + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + SMB1 + Dword + + + <VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mrxsmb10 + False + + Different methods are available to disable SMBv1 on Windows Server 2019, if WN19-00-000380 is configured, this is NA. + +If the following registry value is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\ + +Value Name: Start + +Type: REG_DWORD +Value: 0x00000004 (4) + 4 + Start + Dword + + + <VulnDiscussion>Slide shows that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged-on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization + False + + Verify the registry value below. + +If it does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Personalization\ + +Value Name: NoLockScreenSlideshow + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + NoLockScreenSlideshow + Dword + + + <VulnDiscussion>When the WDigest Authentication protocol is enabled, plain-text passwords are stored in the Local Security Authority Subsystem Service (LSASS), exposing them to theft. WDigest is disabled by default in Windows Server 2019. This setting ensures this is enforced.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest\ + +Value Name: UseLogonCredential + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + UseLogonCredential + Dword + + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and will prevent uncontrolled updates to the system. + +This setting prevents the computer from downloading print driver packages over HTTP.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\ + +Value Name: DisableWebPnPDownload + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DisableWebPnPDownload + Dword + + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and will prevent uncontrolled updates to the system. + +This setting prevents the client computer from printing over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\ + +Value Name: DisableHTTPPrinting + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DisableHTTPPrinting + Dword + + + <VulnDiscussion>Enabling interaction with the network selection UI allows users to change connections to available networks without signing in to Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + False + + Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ + +Value Name: DontDisplayNetworkSelectionUI + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DontDisplayNetworkSelectionUI + Dword + + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and will prevent uncontrolled updates to the system. + +This setting will prevent the Program Inventory from collecting data about a system and sending the information to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppCompat\ + +Value Name: DisableInventory + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DisableInventory + Dword + + + <VulnDiscussion>Windows Defender SmartScreen helps protect systems from programs downloaded from the internet that may be malicious. Enabling SmartScreen can block potentially malicious programs or warn users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + False + + This is applicable to unclassified systems; for other systems, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ + +Value Name: EnableSmartScreen + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + EnableSmartScreen + Dword + + + <VulnDiscussion>Basic authentication uses plain-text passwords that could be used to compromise a system. Disabling Basic authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds + False + + The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections. + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0x00000000 (0) (or if the Value Name does not exist)", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds\ + +Value Name: AllowBasicAuthInClear + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist) + 0 + AllowBasicAuthInClear + Dword + + + <VulnDiscussion>Indexing of encrypted files may expose sensitive data. This setting prevents encrypted files from being indexed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Search + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Windows Search\ + +Value Name: AllowIndexingEncryptedStoresOrItems + +Value Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AllowIndexingEncryptedStoresOrItems + Dword + + + <VulnDiscussion>Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system. The system must be configured to prevent users from saving passwords in the Remote Desktop Client. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: DisablePasswordSaving + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DisablePasswordSaving + Dword + + + <VulnDiscussion>This setting controls the ability of users to supply passwords automatically as part of their remote desktop connection. Disabling this setting would allow anyone to use the stored credentials in a connection item to connect to the terminal server. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fPromptForPassword + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + fPromptForPassword + Dword + + + <VulnDiscussion>Storage of administrative credentials could allow unauthorized access. Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ + +Value Name: DisableRunAs + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DisableRunAs + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the built-in Administrator account so that it runs in Admin Approval Mode. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: FilterAdministratorToken + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + FilterAdministratorToken + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting controls the behavior of elevation when requested by a standard user account. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: ConsentPromptBehaviorUser + +Value Type: REG_DWORD +Value: 0x00000000 (0) + 0 + ConsentPromptBehaviorUser + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting enables UAC. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableLUA + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + EnableLUA + Dword + + + <VulnDiscussion>Computer account passwords are changed automatically on a regular basis. Disabling automatic password changes can make the system more vulnerable to malicious access. Frequent password changes can be a significant safeguard for the system. A new password for the computer account will be generated every 30 days.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: DisablePasswordChange + +Value Type: REG_DWORD +Value: 0x00000000 (0) + 0 + DisablePasswordChange + Dword + + + <VulnDiscussion>The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords. This setting controls whether a LAN Manager hash of the password is stored in the SAM the next time the password is changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: NoLMHash + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + NoLMHash + Dword + + + <VulnDiscussion>Some non-Microsoft SMB servers only support unencrypted (plain-text) password authentication. Sending plain-text passwords across the network when authenticating to an SMB server reduces the overall security of the environment. Check with the vendor of the SMB server to determine if there is a way to support encrypted password authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ + +Value Name: EnablePlainTextPassword + +Value Type: REG_DWORD +Value: 0x00000000 (0) + 0 + EnablePlainTextPassword + Dword + + + <VulnDiscussion>If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure. + +The cornerstone of the PKI is the private key used to encrypt or digitally sign information. + +If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user. + +Both the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\ + +Value Name: ForceKeyProtection + +Type: REG_DWORD +Value: 0x00000002 (2) + 2 + ForceKeyProtection + Dword + + + <VulnDiscussion>Certain encryption types are no longer considered secure. The DES and RC4 encryption suites must not be used for Kerberos encryption. + +Note: Organizations with domain controllers running earlier versions of Windows where RC4 encryption is enabled, selecting "The other domain supports Kerberos AES Encryption" on domain trusts, may be required to allow client communication across the trust relationship.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\ + +Value Name: SupportedEncryptionTypes + +Value Type: REG_DWORD +Value: 0x7ffffff8 (2147483640) + 2147483640 + SupportedEncryptionTypes + Dword + + + <VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this. + +Satisfies: SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ + +Value Name: AllowUnencryptedTraffic + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AllowUnencryptedTraffic + Dword + + + <VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this. + +Satisfies: SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ + +Value Name: AllowUnencryptedTraffic + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AllowUnencryptedTraffic + Dword + + + <VulnDiscussion>Basic authentication uses plain-text passwords that could be used to compromise a system. Disabling Basic authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ + +Value Name: AllowBasic + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AllowBasic + Dword + + + <VulnDiscussion>Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks. Disallowing Digest authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ + +Value Name: AllowDigest + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AllowDigest + Dword + + + <VulnDiscussion>Basic authentication uses plain-text passwords that could be used to compromise a system. Disabling Basic authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ + +Value Name: AllowBasic + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AllowBasic + Dword + + + <VulnDiscussion>This setting ensures the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing. FIPS-compliant algorithms meet specific standards established by the U.S. Government and must be the algorithms used for all OS encryption functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy\ + +Value Name: Enabled + +Value Type: REG_DWORD +Value: 0x00000001 (1) + +Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms. Both the browser and web server must be configured to use TLS; otherwise. the browser will not be able to connect to a secure site. + 1 + Enabled + Dword + + + <VulnDiscussion>Enumeration of administrator accounts when elevating can provide part of the logon information to an unauthorized user. This setting configures the system to always require users to type in a username and password to elevate a running application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\ + +Value Name: EnumerateAdministrators + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + EnumerateAdministrators + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting prevents User Interface Accessibility programs from disabling the secure desktop for elevation prompts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableUIADesktopToggle + +Value Type: REG_DWORD +Value: 0x00000000 (0) + 0 + EnableUIADesktopToggle + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the elevation requirements for logged-on administrators to complete a task that requires raised privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + True + '{0}' -match '1|2' + UAC requirements are NA for Server Core installations (this is default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: ConsentPromptBehaviorAdmin + +Value Type: REG_DWORD +Value: 0x00000002 (2) (Prompt for consent on the secure desktop) +0x00000001 (1) (Prompt for credentials on the secure desktop) + + ConsentPromptBehaviorAdmin + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting requires Windows to respond to application installation requests by prompting for credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableInstallerDetection + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + EnableInstallerDetection + Dword + + + <VulnDiscussion>UAC is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures Windows to only allow applications installed in a secure location on the file system, such as the Program Files or the Windows\System32 folders, to run with elevated privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableSecureUIAPaths + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + EnableSecureUIAPaths + Dword + + + <VulnDiscussion>UAC is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures non-UAC-compliant applications to run in virtualized file and registry entries in per-user locations, allowing them to run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableVirtualization + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + EnableVirtualization + Dword + + + <VulnDiscussion>Preventing users from sharing the local drives on their client computers with Remote Session Hosts that they access helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fDisableCdm + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + fDisableCdm + Dword + + + <VulnDiscussion>Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: RestrictAnonymous + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + RestrictAnonymous + Dword + + + <VulnDiscussion>Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access. This setting restricts access to those defined in "Network access: Named Pipes that can be accessed anonymously" and "Network access: Shares that can be accessed anonymously", both of which must be blank under other requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: RestrictNullSessAccess + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + RestrictNullSessAccess + Dword + + + <VulnDiscussion>Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the server's WINS resolution capability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netbt\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netbt\Parameters\ + +Value Name: NoNameReleaseOnDemand + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + NoNameReleaseOnDemand + Dword + + + <VulnDiscussion>Unsigned network traffic is susceptible to man-in-the-middle attacks, where an intruder captures packets between the server and the client and modifies them before forwarding them to the client. In the case of an LDAP server, this means that an attacker could cause a client to make decisions based on false records from the LDAP directory. The risk of an attacker pulling this off can be decreased by implementing strong physical security measures to protect the network infrastructure. Furthermore, implementing Internet Protocol security (IPsec) authentication header mode (AH), which performs mutual authentication and packet integrity for Internet Protocol (IP) traffic, can make all types of man-in-the-middle attacks extremely difficult. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters + False + + This applies to domain controllers. It is NA for other systems. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\NTDS\Parameters\ + +Value Name: LDAPServerIntegrity + +Value Type: REG_DWORD +Value: 0x00000002 (2) + 2 + LDAPServerIntegrity + Dword + + + <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted and signed. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: RequireSignOrSeal + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + RequireSignOrSeal + Dword + + + <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: SealSecureChannel + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + SealSecureChannel + Dword + + + <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked. If this policy is enabled, outgoing secure channel traffic will be signed. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: SignSecureChannel + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + SignSecureChannel + Dword + + + <VulnDiscussion>A computer connecting to a domain controller will establish a secure channel. The secure channel connection may be subject to compromise, such as hijacking or eavesdropping, if strong session keys are not used to establish the connection. Requiring strong session keys enforces 128-bit encryption between systems. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: RequireStrongKey + +Value Type: REG_DWORD +Value: 0x00000001 (1) + +This setting may prevent a system from being joined to a domain if not configured consistently between systems. + 1 + RequireStrongKey + Dword + + + <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ + +Value Name: RequireSecuritySignature + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + RequireSecuritySignature + Dword + + + <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. If this policy is enabled, the SMB client will request packet signing when communicating with an SMB server that is enabled or required to perform SMB packet signing. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ + +Value Name: EnableSecuritySignature + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + EnableSecuritySignature + Dword + + + <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: RequireSecuritySignature + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + RequireSecuritySignature + Dword + + + <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will negotiate SMB packet signing as requested by the client. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: EnableSecuritySignature + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + EnableSecuritySignature + Dword + + + <VulnDiscussion>Data Execution Prevention provides additional protection by performing checks on memory to help prevent malicious code from running. This setting will prevent Data Execution Prevention from being turned off for File Explorer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer + False + + The default behavior is for Data Execution Prevention to be turned on for File Explorer. + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0x00000000 (0) (or if the Value Name does not exist)", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ + +Value Name: NoDataExecutionPrevention + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist) + 0 + NoDataExecutionPrevention + Dword + + + + + <VulnDiscussion>Allowing anonymous SID/Name translation can provide sensitive information for accessing a system. Only authorized users must be able to perform such translations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + Network access: Allow anonymous SID/Name translation + Disabled + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. + +If the value for "Network access: Allow anonymous SID/Name translation" is not set to "Disabled", this is a finding. + + + <VulnDiscussion>The built-in administrator account is a well-known account subject to attack. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + Accounts: Rename administrator account + + True + '{0}' -ne 'Administrator' + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. + +If the value for "Accounts: Rename administrator account" is not set to a value other than "Administrator", this is a finding. + + + + + <VulnDiscussion>The built-in guest account is a well-known user account on all Windows systems and, as initially installed, does not require a password. This can allow access to system resources by unauthorized users. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + Accounts: Rename guest account + + True + '{0}' -ne 'Guest' + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. + +If the value for "Accounts: Rename guest account" is not set to a value other than "Guest", this is a finding. + + + + + <VulnDiscussion>A system faces an increased vulnerability threat if the built-in guest account is not disabled. This is a known account that exists on all Windows systems and cannot be deleted. This account is initialized during the installation of the operating system with no password assigned.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + Accounts: Guest account status + Disabled + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. + +If the value for "Accounts: Guest account status" is not set to "Disabled", this is a finding. + + + + + + + <VulnDiscussion>Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + True + ServiceName/StartupType is populated with correct AntiVirus service information + Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution. + +If there is no anti-virus solution installed on the system, this is a finding. + + + Running + + + + + <VulnDiscussion>A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + True + ServiceName/StartupType is populated with correct Firewall service information + Determine if a host-based firewall is installed and enabled on the system. + +If a host-based firewall is not installed and enabled on the system, this is a finding. + +The configuration requirements will be determined by the applicable firewall STIG. + + + Running + + + + + + + SeDenyRemoteInteractiveLogonRight + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on through Remote Desktop Services" user right defines the accounts that are prevented from logging on using Remote Desktop Services. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Deny log on through Remote Desktop Services + + False + Guests + False + False + + This applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on through Remote Desktop Services" user right, this is a finding: + +- Guests Group + + + + + SeNetworkLogonRight + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Access this computer from the network" right may access resources on the system, and this right must be limited to those requiring it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Access this computer from the network + + True + Administrators,Authenticated Users,Enterprise Domain Controllers + False + False + + This applies to domain controllers. It is NA for other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Access this computer from the network" right, this is a finding. + +- Administrators +- Authenticated Users +- Enterprise Domain Controllers + + + + + SeRemoteInteractiveLogonRight + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Allow log on through Remote Desktop Services" user right can access a system through Remote Desktop.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Allow log on through Remote Desktop Services + + True + Administrators + False + False + + This applies to domain controllers, it is NA for other systems. + +Verify the effective setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Allow log on through Remote Desktop Services" user right, this is a finding. + +- Administrators + + + + + SeDenyNetworkLogonRight + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny access to this computer from the network" user right defines the accounts that are prevented from logging on from the network. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Deny access to this computer from the network + + False + Guests + False + False + + This applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny access to this computer from the network" user right, this is a finding: + +- Guests Group + + + + + SeDenyBatchLogonRight + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on as a batch job" user right defines accounts that are prevented from logging on to the system as a batch job, such as Task Scheduler. + +The Guests group must be assigned to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Deny log on as a batch job + + False + Guests + False + False + + This applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on as a batch job" user right, this is a finding: + +- Guests Group + + + + + SeDenyServiceLogonRight + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on as a service" user right defines accounts that are denied logon as a service. + +Incorrect configurations could prevent services from starting and result in a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Deny log on as a service + + True + NULL + False + False + + This applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are defined for the "Deny log on as a service" user right, this is a finding. + + + + + SeDenyInteractiveLogonRight + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on locally" user right defines accounts that are prevented from logging on interactively. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Deny log on locally + + False + Guests + False + False + + This applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on locally" user right, this is a finding: + +- Guests Group + + + + + SeInteractiveLogonRight + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Allow log on locally" user right can log on interactively to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Allow log on locally + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Allow log on locally" user right, this is a finding: + +- Administrators + + + + + SeMachineAccountPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Add workstations to domain" right may add computers to a domain. This could result in unapproved or incorrectly configured systems being added to a domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Add workstations to domain + + True + Administrators + False + False + + This applies to domain controllers. It is NA for other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Add workstations to domain" right, this is a finding. + +- Administrators + + + + + SeEnableDelegationPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Enable computer and user accounts to be trusted for delegation" user right allows the "Trusted for Delegation" setting to be changed. This could allow unauthorized users to impersonate other users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Enable computer and user accounts to be trusted for delegation + + True + Administrators + False + False + + This applies to domain controllers. A separate version applies to other systems. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Enable computer and user accounts to be trusted for delegation" user right, this is a finding. + +- Administrators + + + + + SeTrustedCredManAccessPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Access Credential Manager as a trusted caller" user right may be able to retrieve the credentials of other accounts from Credential Manager.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Access Credential Manager as a trusted caller + + True + NULL + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Access Credential Manager as a trusted caller" user right, this is a finding. + + + + + SeTcbPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Act as part of the operating system" user right can assume the identity of any user and gain access to resources that the user is authorized to access. Any accounts with this right can take complete control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Act as part of the operating system + + True + NULL + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups (to include administrators), are granted the "Act as part of the operating system" user right, this is a finding. + + + + + SeBackupPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Back up files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Back up files and directories + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Back up files and directories" user right, this is a finding: + +- Administrators + + + + + SeCreatePagefilePrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create a pagefile" user right can change the size of a pagefile, which could affect system performance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Create a pagefile + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Create a pagefile" user right, this is a finding: + +- Administrators + + + + + SeCreateTokenPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Create a token object" user right allows a process to create an access token. This could be used to provide elevated rights and compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Create a token object + + True + NULL + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Create a token object" user right, this is a finding. + + + + + SeCreateGlobalPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create global objects" user right can create objects that are available to all sessions, which could affect processes in other users' sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Create global objects + + True + Administrators,Service,Local Service,Network Service + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Create global objects" user right, this is a finding: + +- Administrators +- Service +- Local Service +- Network Service + + + + + SeCreatePermanentPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create permanent shared objects" user right could expose sensitive data by creating shared objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Create permanent shared objects + + True + NULL + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Create permanent shared objects" user right, this is a finding. + + + + + SeCreateSymbolicLinkPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create symbolic links" user right can create pointers to other objects, which could expose the system to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Create symbolic links + + True + + False + True + '{0}' -match '^(Administrators,NT Virtual Machine\\Virtual Machines|Administrators)$' + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Create symbolic links" user right, this is a finding: + +- Administrators + + + + + SeDebugPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Debug programs" user right can attach a debugger to any process or to the kernel, providing complete access to sensitive and critical operating system components. This right is given to Administrators in the default configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Debug programs + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Debug programs" user right, this is a finding: + +- Administrators + + + + + SeRemoteShutdownPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Force shutdown from a remote system" user right can remotely shut down a system, which could result in a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Force shutdown from a remote system + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Force shutdown from a remote system" user right, this is a finding: + +- Administrators + + + + + SeAuditPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Generate security audits" user right specifies users and processes that can generate Security Log audit records, which must only be the system service accounts defined.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Generate security audits + + True + Local Service,Network Service + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Generate security audits" user right, this is a finding: + +- Local Service +- Network Service + + + + + SeImpersonatePrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Impersonate a client after authentication" user right allows a program to impersonate another user or account to run on their behalf. An attacker could use this to elevate privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Impersonate a client after authentication + + True + Administrators,Service,Local Service,Network Service + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Impersonate a client after authentication" user right, this is a finding: + +- Administrators +- Service +- Local Service +- Network Service + + + + + SeIncreaseBasePriorityPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Increase scheduling priority" user right can change a scheduling priority, causing performance issues or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Increase scheduling priority + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Increase scheduling priority" user right, this is a finding: + +- Administrators + + + + + SeLoadDriverPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Load and unload device drivers" user right allows a user to load device drivers dynamically on a system. This could be used by an attacker to install malicious code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Load and unload device drivers + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Load and unload device drivers" user right, this is a finding: + +- Administrators + + + + + SeLockMemoryPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Lock pages in memory" user right allows physical memory to be assigned to processes, which could cause performance issues or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Lock pages in memory + + True + NULL + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Lock pages in memory" user right, this is a finding. + + + + + SeSystemEnvironmentPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Modify firmware environment values" user right can change hardware configuration environment variables. This could result in hardware failures or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Modify firmware environment values + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Modify firmware environment values" user right, this is a finding: + +- Administrators + + + + + SeManageVolumePrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Perform volume maintenance tasks" user right can manage volume and disk configurations. This could be used to delete volumes, resulting in data loss or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Perform volume maintenance tasks + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Perform volume maintenance tasks" user right, this is a finding: + +- Administrators + + + + + SeProfileSingleProcessPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Profile single process" user right can monitor non-system processes performance. An attacker could use this to identify processes to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Profile single process + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Profile single process" user right, this is a finding: + +- Administrators + + + + + SeRestorePrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Restore files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data. It could also be used to overwrite more current data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Restore files and directories + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Restore files and directories" user right, this is a finding: + +- Administrators + + + + + SeTakeOwnershipPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Take ownership of files or other objects" user right can take ownership of objects and make changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Take ownership of files or other objects + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Take ownership of files or other objects" user right, this is a finding: + +- Administrators + + + + + SeSecurityPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Manage auditing and security log" user right can manage the security log and change auditing configurations. This could be used to clear evidence of tampering. + +Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000063-GPOS-00032, SRG-OS-000337-GPOS-00129</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Manage auditing and security log + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Manage auditing and security log" user right, this is a finding. + +- Administrators + + + + + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + Fax + False + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq Fax". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + PNRP + False + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq PNRP". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + Simple-TCPIP + False + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq Simple-TCPIP". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + TFTP-Client + False + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq TFTP-Client". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + <VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks and is not FIPS compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + FS-SMB1 + False + + Different methods are available to disable SMBv1 on Windows Server 2019. This is the preferred method, however if WN19-00-000390 and WN19-00-000400 are configured, this is NA. + +Open "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-WindowsFeature -Name FS-SMB1". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + <VulnDiscussion>Windows PowerShell 5.x added advanced logging features that can provide additional detail when malware has been run on a system. Disabling the Windows PowerShell 2.0 mitigates against a downgrade attack that evades the Windows PowerShell 5.x script block logging feature.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + PowerShell-v2 + False + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq PowerShell-v2". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + Web-Ftp-Service + False + + If the server has the role of an FTP server, this is NA. + +Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq Web-Ftp-Service". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + +If the system has the role of an FTP server, this must be documented with the ISSO. + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + Telnet-Client + False + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq Telnet-Client". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + diff --git a/StigData/Processed/WindowsServer-2019-MS-1.2.org.default.xml b/StigData/Processed/WindowsServer-2019-MS-1.2.org.default.xml new file mode 100644 index 000000000..bffdc6359 --- /dev/null +++ b/StigData/Processed/WindowsServer-2019-MS-1.2.org.default.xml @@ -0,0 +1,61 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/StigData/Processed/WindowsServer-2019-MS-1.2.xml b/StigData/Processed/WindowsServer-2019-MS-1.2.xml new file mode 100644 index 000000000..9c800323e --- /dev/null +++ b/StigData/Processed/WindowsServer-2019-MS-1.2.xml @@ -0,0 +1,7281 @@ + + + + <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack while allowing for honest errors made during normal user logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -le '3' -and '{0}' -ne '0' + Account lockout threshold + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. + +If the "Account lockout threshold" is "0" or more than "3" attempts, this is a finding. + + + + + <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to "0". The smaller this value is, the less effective the account lockout feature will be in protecting the local system. + +Satisfies: SRG-OS-000021-GPOS-00005, SRG-OS-000329-GPOS-00128</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -ge '15' + Reset account lockout counter after + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. + +If the "Reset account lockout counter after" value is less than "15" minutes, this is a finding. + + + + + <VulnDiscussion>The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that an account will remain locked after the specified number of failed logon attempts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -ge '15' -or '{0}' -eq '0' + Account lockout duration + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. + +If the "Account lockout duration" is less than "15" minutes (excluding "0"), this is a finding. + + + + + <VulnDiscussion>The use of complex passwords increases their strength against attack. The built-in Windows password complexity policy requires passwords to contain at least three of the four types of characters (numbers, uppercase and lowercase letters, and special characters) and prevents the inclusion of user names or parts of user names. + +Satisfies: SRG-OS-000069-GPOS-00037, SRG-OS-000070-GPOS-00038, SRG-OS-000071-GPOS-00039, SRG-OS-000266-GPOS-00101</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Password must meet complexity requirements + Enabled + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for "Password must meet complexity requirements" is not set to "Enabled", this is a finding. + + + + + <VulnDiscussion>Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system and compromising the device, information, or the local network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -ge '14' + Minimum password length + + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for the "Minimum password length," is less than "14" characters, this is a finding. + + + + + <VulnDiscussion>Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords, which are easily compromised. For this reason, this policy must never be enabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Store passwords using reversible encryption + Disabled + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for "Store passwords using reversible encryption" is not set to "Disabled", this is a finding. + + + + + <VulnDiscussion>Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database. This enables users to effectively negate the purpose of mandating periodic password changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -ne '0' + Minimum password age + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for the "Minimum password age" is set to "0" days ("Password can be changed immediately"), this is a finding. + + + + + <VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -le '60' -and '{0}' -ne '0' + Maximum password age + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for the "Maximum password age" is greater than "60" days, this is a finding. + +If the value is set to "0" (never expires), this is a finding. + + + + + <VulnDiscussion>A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change to a unique password on a regularly scheduled basis. This enables users to effectively negate the purpose of mandating periodic password changes. The default value is "24" for Windows domain systems. DoD has decided this is the appropriate value for all Windows systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + True + '{0}' -ge '24' + Enforce password history + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. + +If the value for "Enforce password history" is less than "24" passwords remembered, this is a finding. + + + + + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed. + +Satisfies: SRG-OS-000032-GPOS-00013, SRG-OS-000470-GPOS-00214, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000475-GPOS-00220</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Logon - Success + Logon + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed. + +Satisfies: SRG-OS-000032-GPOS-00013, SRG-OS-000470-GPOS-00214, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000475-GPOS-00220</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Logon - Failure + Logon + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Security Group Management records events such as creating, deleting, or changing security groups, including changes in group members. + +Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Management >> Security Group Management - Success + Security Group Management + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts. + +Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Management >> User Account Management - Success + User Account Management + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts. + +Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Management >> User Account Management - Failure + User Account Management + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Account Lockout events can be used to identify potentially malicious logon attempts. + +Satisfies: SRG-OS-000240-GPOS-00090, SRG-OS-000470-GPOS-00214</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Account Lockout - Success + Account Lockout + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Account Lockout events can be used to identify potentially malicious logon attempts. + +Satisfies: SRG-OS-000240-GPOS-00090, SRG-OS-000470-GPOS-00214</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Account Lockout - Failure + Account Lockout + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Other Account Management Events records events such as the access of a password hash or the Password Policy Checking API being called. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding: + +Account Management >> Other Account Management Events - Success + Other Account Management Events + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Process Creation records events related to the creation of a process and the source. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000471-GPOS-00215</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Detailed Tracking >> Process Creation - Success + Process Creation + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Policy Change records events related to changes in audit policy. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Policy Change >> Audit Policy Change - Success + Audit Policy Change + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Policy Change records events related to changes in audit policy. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Policy Change >> Audit Policy Change - Failure + Audit Policy Change + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Authentication Policy Change records events related to changes in authentication policy, including Kerberos policy and Trust changes. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Policy Change >> Authentication Policy Change - Success + Authentication Policy Change + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Authorization Policy Change records events related to changes in user rights, such as "Create a token object". + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Policy Change >> Authorization Policy Change - Success + Authorization Policy Change + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs". + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Privilege Use >> Sensitive Privilege Use - Success + Sensitive Privilege Use + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Sensitive Privilege Use records events related to use of sensitive privileges, such as "Act as part of the operating system" or "Debug programs". + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000064-GPOS-00033, SRG-OS-000462-GPOS-00206, SRG-OS-000466-GPOS-00210</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Privilege Use >> Sensitive Privilege Use - Failure + Sensitive Privilege Use + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +IPsec Driver records events related to the IPsec Driver, such as dropped packets. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> IPsec Driver - Success + IPsec Driver + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +IPsec Driver records events related to the IPsec Driver, such as dropped packets. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> IPsec Driver - Failure + IPsec Driver + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> Other System Events - Success + Other System Events + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Other System Events records information related to cryptographic key operations and the Windows Firewall service. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> Other System Events - Failure + Other System Events + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Security State Change records events related to changes in the security state, such as startup and shutdown of the system. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> Security State Change - Success + Security State Change + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Security System Extension records events related to extension code being loaded by the security subsystem. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000458-GPOS-00203, SRG-OS-000463-GPOS-00207, SRG-OS-000468-GPOS-00212</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> Security System Extension - Success + Security System Extension + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +System Integrity records events related to violations of integrity to the security subsystem. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> System Integrity - Success + System Integrity + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +System Integrity records events related to violations of integrity to the security subsystem. + +Satisfies: SRG-OS-000327-GPOS-00127, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +System >> System Integrity - Failure + System Integrity + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Credential Validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Logon >> Credential Validation - Success + Credential Validation + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Credential Validation records events related to validation tests on credentials for a user account logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Account Logon >> Credential Validation - Failure + Credential Validation + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Plug and Play activity records events related to the successful connection of external devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Detailed Tracking >> Plug and Play Events - Success + Plug and Play Events + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Audit Group Membership records information related to the group membership of a user's logon token.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Group Membership - Success + Group Membership + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Special Logon records special logons that have administrative privileges and can be used to elevate processes. + +Satisfies: SRG-OS-000470-GPOS-00214, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000475-GPOS-00220</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Special Logon - Success + Special Logon + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Auditing for other object access records events related to the management of task scheduler jobs and COM+ objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Object Access >> Other Object Access Events - Success + Other Object Access Events + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Auditing for other object access records events related to the management of task scheduler jobs and COM+ objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Object Access >> Other Object Access Events - Failure + Other Object Access Events + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Object Access >> Removable Storage - Success + +Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding. + Removable Storage + + + Failure + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Removable Storage auditing under Object Access records events related to access attempts on file system objects on removable storage devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Object Access >> Removable Storage - Failure + +Virtual machines or systems that use network attached storage may generate excessive audit events for secondary virtual drives or the network attached storage when this setting is enabled. This may be set to Not Configured in such cases and would not be a finding. + Removable Storage + + + Success + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Logoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed. + +Satisfies: SRG-OS-000472-GPOS-00217, SRG-OS-000480-GPOS-00227</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + False + + Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN19-SO-000050) for the detailed auditing subcategories to be effective. + +Use the "AuditPol" tool to review the current Audit Policy configuration: + +Open "PowerShell" or a "Command Prompt" with elevated privileges ("Run as administrator"). + +Enter "AuditPol /get /category:*" + +Compare the "AuditPol" settings with the following: + +If the system does not audit the following, this is a finding. + +Logon/Logoff >> Logoff - Success + Logoff + + + + + <VulnDiscussion>The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system. To support this, volumes must be formatted using a file system that supports NTFS attributes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + NTFS|ReFS + + False + -match + False + + FileSystem + SELECT * FROM Win32_LogicalDisk WHERE DriveType = '3' + Open "Computer Management". + +Select "Disk Management" under "Storage". + +For each local volume, if the file system does not indicate "NTFS", this is a finding. + +"ReFS" (resilient file system) is also acceptable and would not be a finding. + +This does not apply to system partitions such the Recovery and EFI System Partition. + + + <VulnDiscussion>Systems at unsupported servicing levels will not receive security updates for new vulnerabilities, which leave them subject to exploitation. Systems must be maintained at a servicing level supported by the vendor with new security updates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + 10.0.17763 + + False + -le + False + + Version + SELECT * FROM Win32_OperatingSystem + Open "Command Prompt". + +Enter "winver.exe". + +If the "About Windows" dialog box does not display "Microsoft Windows Server Version 1809 (Build 17763.xxx)" or greater, this is a finding. + +Preview versions must not be used in a production environment. + + + + + <VulnDiscussion>A properly configured Host-based Intrusion Detection System (HIDS) or Host-based Intrusion Prevention System (HIPS) provides another level of defense against unauthorized access to critical servers. With proper configuration and logging enabled, such a system can stop and/or alert for many attempts to gain unauthorized access to resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine whether there is a HIDS or HIPS on each server. + +If the HIPS component of HBSS is installed and active on the host and the alerts of blocked activity are being logged and monitored, this meets the requirement. + +A HIDS device is not required on a system that has the role as the Network Intrusion Device (NID). However, this exception needs to be documented with the ISSO. + +If a HIDS is not installed on the system, this is a finding. + + + <VulnDiscussion>Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Search all drives for *.p12 and *.pfx files. + +If any files with these extensions exist, this is a finding. + +This does not apply to server-based applications that have a requirement for .p12 certificate files or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO. + + + <VulnDiscussion>Unnecessary roles and features increase the attack surface of a system. Limiting roles and features of a system to only those necessary reduces this potential. The standard installation option (previously called Server Core) further reduces this when selected at installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Required roles and features will vary based on the function of the individual system. + +Roles and features specifically required to be disabled per the STIG are identified in separate requirements. + +If the organization has not documented the roles and features required for the system(s), this is a finding. + +The PowerShell command "Get-WindowsFeature" will list all roles and features with an "Install State". + + + <VulnDiscussion>Shared accounts (accounts where two or more people log on with the same user identification) do not provide adequate identification and authentication. There is no way to provide for nonrepudiation or individual accountability for system access and resource usage.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine whether any shared accounts exist. If no shared accounts exist, this is NA. + +Shared accounts, such as required by an application, may be approved by the organization. This must be documented with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity. + +If unapproved shared accounts exist, this is a finding. + + + <VulnDiscussion>Outdated or unused accounts provide penetration points that may go undetected. Inactive accounts must be deleted if no longer necessary or, if still required, disabled until needed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Open "Windows PowerShell". + +Domain Controllers: + +Enter "Search-ADAccount -AccountInactive -UsersOnly -TimeSpan 35.00:00:00" + +This will return accounts that have not been logged on to for 35 days, along with various attributes such as the Enabled status and LastLogonDate. + +Member servers and standalone systems: + +Copy or enter the lines below to the PowerShell window and enter. (Entering twice may be required. Do not include the quotes at the beginning and end of the query.) + +"([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach { + $user = ([ADSI]$_.Path) + $lastLogin = $user.Properties.LastLogin.Value + $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2 + if ($lastLogin -eq $null) { + $lastLogin = 'Never' + } + Write-Host $user.Name $lastLogin $enabled +}" + +This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False). +For example: User1 10/31/2015 5:49:56 AM True + +Review the list of accounts returned by the above queries to determine the finding validity for each account reported. + +Exclude the following accounts: + +- Built-in administrator account (Renamed, SID ending in 500) +- Built-in guest account (Renamed, Disabled, SID ending in 501) +- Application accounts + +If any enabled accounts have not been logged on to within the past 35 days, this is a finding. + +Inactive accounts that have been reviewed and deemed to be required must be documented with the ISSO. + + + <VulnDiscussion>To ensure secure DoD websites and DoD-signed code are properly validated, the system must trust the DoD Root CAs. The DoD root certificates will ensure that the trust chain is established for server certificates issued from the DoD CAs. + +Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + The certificates and thumbprints referenced below apply to unclassified systems; see PKE documentation for other networks. + +Open "Windows PowerShell" as an administrator. + +Execute the following command: + +Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*DoD*" | FL Subject, Thumbprint, NotAfter + +If the following certificate "Subject" and "Thumbprint" information is not displayed, this is a finding. + +If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. + +Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561 +NotAfter: 12/5/2029 + +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB +NotAfter: 12/30/2029 + +Subject: CN=DoD Root CA 4, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026 +NotAfter: 7/25/2032 + +Subject: CN=DoD Root CA 5, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B +NotAfter: 6/14/2041 + +Alternately, use the Certificates MMC snap-in: + +Run "MMC". + +Select "File", "Add/Remove Snap-in". + +Select "Certificates" and click "Add". + +Select "Computer account" and click "Next". + +Select "Local computer: (the computer this console is running on)" and click "Finish". + +Click "OK". + +Expand "Certificates" and navigate to "Trusted Root Certification Authorities >> Certificates". + +For each of the DoD Root CA certificates noted below: + +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the DoD Root CA certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. + +DoD Root CA 2 +Thumbprint: 8C941B34EA1EA6ED9AE2BC54CF687252B4C9B561 +Valid to: Wednesday, December 5, 2029 + +DoD Root CA 3 +Thumbprint: D73CA91102A2204A36459ED32213B467D7CE97FB +Valid to: Sunday, December 30, 2029 + +DoD Root CA 4 +Thumbprint: B8269F25DBD937ECAFD4C35A9838571723F2D026 +Valid to: Sunday, July 25, 2032 + +DoD Root CA 5 +Thumbprint: 4ECB5CC3095670454DA1CBD410FC921F46B8564B +Valid to: Friday, June 14, 2041 + + + <VulnDiscussion>Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. The operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify DoD approved HBSS software is installed, configured, and properly operating. Ask the operator to document the HBSS software installation and configuration. + +If the operator is not able to provide a documented configuration for an installed HBSS or if the HBSS software is not properly configured, maintained, or used, this is a finding. + + + + + <VulnDiscussion>If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation. + +Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. + +If temporary accounts are used, the operating system must be configured to automatically terminate these types of accounts after a DoD-defined time period of 72 hours. + +To address access requirements, many operating systems may be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review temporary user accounts for expiration dates. + +Determine if temporary user accounts are used and identify any that exist. If none exist, this is NA. + +Domain Controllers: + +Open "PowerShell". + +Enter "Search-ADAccount -AccountExpiring | FT Name, AccountExpirationDate". + +If "AccountExpirationDate" has not been defined within 72 hours for any temporary user account, this is a finding. + +Member servers and standalone systems: + +Open "Command Prompt". + +Run "Net user [username]", where [username] is the name of the temporary user account. + +If "Account expires" has not been defined within 72 hours for any temporary user account, this is a finding. + + + <VulnDiscussion>Emergency administrator accounts are privileged accounts established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability. + +Emergency administrator accounts are different from infrequently used accounts (i.e., local logon accounts used by system administrators when network or normal logon/access is not available). Infrequently used accounts are not subject to automatic termination dates. Emergency accounts are accounts created in response to crisis situations, usually for use by maintenance personnel. The automatic expiration or disabling time period may be extended as needed until the crisis is resolved; however, it must not be extended indefinitely. A permanent account should be established for privileged users who need long-term maintenance accounts. + +To address access requirements, many operating systems can be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine if emergency administrator accounts are used and identify any that exist. If none exist, this is NA. + +If emergency administrator accounts cannot be configured with an expiration date due to an ongoing crisis, the accounts must be disabled or removed when the crisis is resolved. + +If emergency administrator accounts have not been configured with an expiration date or have not been disabled or removed following the resolution of a crisis, this is a finding. + +Domain Controllers: + +Open "PowerShell". + +Enter "Search-ADAccount -AccountExpiring | FT Name, AccountExpirationDate". + +If "AccountExpirationDate" has been defined and is not within 72 hours for an emergency administrator account, this is a finding. + +Member servers and standalone systems: + +Open "Command Prompt". + +Run "Net user [username]", where [username] is the name of the emergency account. + +If "Account expires" has been defined and is not within 72 hours for an emergency administrator account, this is a finding. + + + <VulnDiscussion>Windows shares are a means by which files, folders, printers, and other resources can be published for network users to access. Improper configuration can permit access to devices and data beyond a user's need.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Open "Printers & scanners" in "Settings". + +If there are no printers configured, this is NA. (Exclude Microsoft Print to PDF and Microsoft XPS Document Writer, which do not support sharing.) + +For each printer: + +Select the printer and "Manage". + +Select "Printer Properties". + +Select the "Sharing" tab. + +If "Share this printer" is checked, select the "Security" tab. + +If any standard user accounts or groups have permissions other than "Print", this is a finding. + +The default is for the "Everyone" group to be given "Print" permission. + +"All APPLICATION PACKAGES" and "CREATOR OWNER" are not standard user accounts. + + + <VulnDiscussion>An account that does not have Administrator duties must not have Administrator rights. Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack. + +System administrators must log on to systems using only accounts with the minimum level of authority necessary. + +For domain-joined member servers, the Domain Admins group must be replaced by a domain member server administrator group (see V-36433 in the Active Directory Domain STIG). Restricting highly privileged accounts from the local Administrators group helps mitigate the risk of privilege escalation resulting from credential theft attacks. + +Standard user accounts must not be members of the built-in Administrators group.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This applies to member servers and standalone systems. A separate version applies to domain controllers. + +Open "Computer Management". + +Navigate to "Groups" under "Local Users and Groups". + +Review the local "Administrators" group. + +Only administrator groups or accounts responsible for administration of the system may be members of the group. + +For domain-joined member servers, the Domain Admins group must be replaced by a domain member server administrator group. + +Standard user accounts must not be members of the local Administrator group. + +If accounts that do not have responsibility for administration of the system are members of the local Administrators group, this is a finding. + +If the built-in Administrator account or other required administrative accounts are found on the system, this is not a finding. + + + <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine if a process to back up log data to a different system or media than the system being audited has been implemented. + +If it has not, this is a finding. + + + <VulnDiscussion>Protection of log data includes assuring the log data is not accidentally lost or deleted. Audit information stored in one location is vulnerable to accidental or incidental deletion or alteration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify the audit records, at a minimum, are off-loaded for interconnected systems in real time and off-loaded for standalone systems weekly. + +If they are not, this is a finding. + + + <VulnDiscussion>The Windows Time Service controls time synchronization settings. Time synchronization is essential for authentication and auditing purposes. If the Windows Time Service is used, it must synchronize with a secure, authorized time source. Domain-joined systems are automatically configured to synchronize with domain controllers. If an NTP server is configured, it must synchronize with a secure, authorized time source.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the Windows time service configuration. + +Open an elevated "Command Prompt" (run as administrator). + +Enter "W32tm /query /configuration". + +Domain-joined systems (excluding the domain controller with the PDC emulator role): + +If the value for "Type" under "NTP Client" is not "NT5DS", this is a finding. + +Other systems: + +If systems are configured with a "Type" of "NTP", including standalone systems and the domain controller with the PDC Emulator role, and do not have a DoD time server defined for "NTPServer", this is a finding. + +To determine the domain controller with the PDC Emulator role: + +Open "PowerShell". + +Enter "Get-ADDomain | FT PDCEmulator". + + + <VulnDiscussion>Monitoring system files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine whether the system is monitored for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis. + +If system files are not monitored for unauthorized changes, this is a finding. + +A properly configured HBSS Policy Auditor 5.2 or later File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement. + + + <VulnDiscussion>Using applications that access the Internet or have potential Internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account. + +Since administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy require administrative accounts to not access the Internet or use applications such as email. + +The policy should define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices. + +Whitelisting can be used to enforce the policy to ensure compliance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine whether organization policy, at a minimum, prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration. + +If it does not, this is a finding. + +The organization may use technical means such as whitelisting to prevent the use of browsers and mail applications to enforce this requirement. + + + <VulnDiscussion>Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Members of the Backup Operators group must have separate logon accounts for performing backup duties.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If no accounts are members of the Backup Operators group, this is NA. + +Verify users with accounts in the Backup Operators group have a separate user account for backup functions and for performing normal user tasks. + +If users with accounts in the Backup Operators group do not have separate accounts for backup functions and standard user functions, this is a finding. + + + <VulnDiscussion>Setting application account passwords to expire may cause applications to stop functioning. However, not changing them on a regular basis exposes them to attack. If managed service accounts are used, this alleviates the need to manually change application account passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine if manually managed application/service accounts exist. If none exist, this is NA. + +If passwords for manually managed application/service accounts are not changed at least annually or when an administrator with knowledge of the password leaves the organization, this is a finding. + +Identify manually managed application/service accounts. + +To determine the date a password was last changed: + +Domain controllers: + +Open "PowerShell". + +Enter "Get-AdUser -Identity [application account name] -Properties PasswordLastSet | FT Name, PasswordLastSet", where [application account name] is the name of the manually managed application/service account. + +If the "PasswordLastSet" date is more than one year old, this is a finding. + + +Member servers and standalone systems: + +Open "Command Prompt". + +Enter 'Net User [application account name] | Find /i "Password Last Set"', where [application account name] is the name of the manually managed application/service account. + +If the "Password Last Set" date is more than one year old, this is a finding. + + + <VulnDiscussion>Credential Guard uses virtualization-based security to protect data that could be used in credential theft attacks if compromised. A number of system requirements must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + For standalone systems, this is NA. + +Current hardware and virtual environments may not support virtualization-based security features, including Credential Guard, due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within a virtual machine. + +Verify the system has a TPM and it is ready for use. + +Run "tpm.msc". + +Review the sections in the center pane. + +"Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has been taken". + +TPM Manufacturer Information - Specific Version = 2.0 or 1.2 + +If a TPM is not found or is not ready for use, this is a finding. + + + <VulnDiscussion>The FTP service allows remote users to access shared files and directories. Allowing anonymous FTP connections makes user auditing difficult. + +Using accounts that have administrator privileges to log on to FTP risks that the userid and password will be captured on the network and give administrator access to an unauthorized user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If FTP is not installed on the system, this is NA. + +Open "Internet Information Services (IIS) Manager". + +Select the server. + +Double-click "FTP Authentication". + +If the "Anonymous Authentication" status is "Enabled", this is a finding. + + + <VulnDiscussion>The FTP service allows remote users to access shared files and directories that could provide access to system resources and compromise the system, especially if the user can gain access to the root directory of the boot drive.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If FTP is not installed on the system, this is NA. + +Open "Internet Information Services (IIS) Manager". + +Select "Sites" under the server name. + +For any sites with a Binding that lists FTP, right-click the site and select "Explore". + +If the site is not defined to a specific folder for shared FTP resources, this is a finding. + +If the site includes any system areas such as root of the drive, Program Files, or Windows directories, this is a finding. + + + <VulnDiscussion>UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows, including Virtualization Based Security and Credential Guard. Systems with UEFI that are operating in "Legacy BIOS" mode will not support these security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must run in "UEFI" mode. + +Verify the system firmware is configured to run in "UEFI" mode, not "Legacy BIOS". + +Run "System Information". + +Under "System Summary", if "BIOS Mode" does not display "UEFI", this is a finding. + + + <VulnDiscussion>Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows, including Virtualization Based Security and Credential Guard. If Secure Boot is turned off, these security features will not function.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Some older systems may not have UEFI firmware. This is currently a CAT III; it will be raised in severity at a future date when broad support of Windows hardware and firmware requirements are expected to be met. Devices that have UEFI firmware must have Secure Boot enabled. + +Run "System Information". + +Under "System Summary", if "Secure Boot State" does not display "On", this is a finding. + +On server core installations, run the following PowerShell command: + +Confirm-SecureBootUEFI + +If a value of "True" is not returned, this is a finding. + + + <VulnDiscussion>Using a privileged account to perform routine functions makes the computer vulnerable to malicious software inadvertently introduced during a session that has been granted full privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify each user with administrative privileges has been assigned a unique administrative account separate from their standard user account. + +If users with administrative privileges do not have separate accounts for administrative functions and standard user functions, this is a finding. + + + <VulnDiscussion>Using a whitelist provides a configuration management method to allow the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. + +The organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This is applicable to unclassified systems. For other systems, this is NA. + +Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. + +If an application whitelisting program is not in use on the system, this is a finding. + +Configuration of whitelisting applications will vary by the program. + +AppLocker is a whitelisting application built into Windows Server. A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules. + +If AppLocker is used, perform the following to view the configuration of AppLocker: + +Open "PowerShell". + +If the AppLocker PowerShell module has not been imported previously, execute the following first: + +Import-Module AppLocker + +Execute the following command, substituting [c:\temp\file.xml] with a location and file name appropriate for the system: + +Get-AppLockerPolicy -Effective -XML > c:\temp\file.xml + +This will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review. + +Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" at the following link: + +https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm + + + <VulnDiscussion>The lack of password protection enables anyone to gain access to the information system, which opens a backdoor opportunity for intruders to compromise the system as well as other resources. Accounts on a system must require passwords.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the password required status for enabled user accounts. + +Open "PowerShell". + +Domain Controllers: + +Enter "Get-Aduser -Filter * -Properties Passwordnotrequired |FT Name, Passwordnotrequired, Enabled". + +Exclude disabled accounts (e.g., DefaultAccount, Guest) and Trusted Domain Objects (TDOs). + +If "Passwordnotrequired" is "True" or blank for any enabled user account, this is a finding. + +Member servers and standalone systems: + +Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordRequired=False and LocalAccount=True" | FT Name, PasswordRequired, Disabled, LocalAccount'. + +Exclude disabled accounts (e.g., DefaultAccount, Guest). + +If any enabled user accounts are returned with a "PasswordRequired" status of "False", this is a finding. + + + <VulnDiscussion>Application/service account passwords must be of sufficient length to prevent being easily cracked. Application/service accounts that are manually managed must have passwords at least 15 characters in length.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Determine if manually managed application/service accounts exist. If none exist, this is NA. + +Verify the organization has a policy to ensure passwords for manually managed application/service accounts are at least 15 characters in length. + +If such a policy does not exist or has not been implemented, this is a finding. + + + <VulnDiscussion>The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password. The built-in Administrator account is not generally used and its password not may be changed as frequently as necessary. Changing the password for the built-in Administrator account on a regular basis will limit its exposure. + +Organizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. LAPS will change the password every "30" days by default.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the password last set date for the built-in Administrator account. + +Domain controllers: + +Open "PowerShell". + +Enter "Get-ADUser -Filter * -Properties SID, PasswordLastSet | Where SID -Like "*-500" | Ft Name, SID, PasswordLastSet". + +If the "PasswordLastSet" date is greater than "60" days old, this is a finding. + +Member servers and standalone systems: + +Open "Command Prompt". + +Enter 'Net User [account name] | Find /i "Password Last Set"', where [account name] is the name of the built-in administrator account. + +(The name of the built-in Administrator account must be changed to something other than "Administrator" per STIG requirements.) + +If the "PasswordLastSet" date is greater than "60" days old, this is a finding. + + + <VulnDiscussion>Passwords that do not expire or are reused increase the exposure of a password with greater probability of being discovered or cracked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the password never expires status for enabled user accounts. + +Open "PowerShell". + +Domain Controllers: + +Enter "Search-ADAccount -PasswordNeverExpires -UsersOnly | FT Name, PasswordNeverExpires, Enabled". + +Exclude application accounts, disabled accounts (e.g., DefaultAccount, Guest) and the krbtgt account. + +If any enabled user accounts are returned with a "PasswordNeverExpires" status of "True", this is a finding. + +Member servers and standalone systems: + +Enter 'Get-CimInstance -Class Win32_Useraccount -Filter "PasswordExpires=False and LocalAccount=True" | FT Name, PasswordExpires, Disabled, LocalAccount'. + +Exclude application accounts and disabled accounts (e.g., DefaultAccount, Guest). + +If any enabled user accounts are returned with a "PasswordExpires" status of "False", this is a finding. + + + <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the DoD Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. + +Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This is applicable to unclassified systems. It is NA for others. + +Open "PowerShell" as an administrator. + +Execute the following command: + +Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, Issuer, Thumbprint, NotAfter + +If the following certificate "Subject", "Issuer", and "Thumbprint" information is not displayed, this is a finding. + +If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. + +Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=DoD Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F +NotAfter: 9/6/2019 + +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: FCE1B1E25374DD94F5935BEB86CA643D8C8D1FF4 +NotAfter: 2/17/2019 + +Alternately, use the Certificates MMC snap-in: + +Run "MMC". + +Select "File", "Add/Remove Snap-in". + +Select "Certificates" and click "Add". + +Select "Computer account" and click "Next". + +Select "Local computer: (the computer this console is running on)" and click "Finish". + +Click "OK". + +Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". + +For each certificate with "DoD Root CA..." under "Issued To" and "DoD Interoperability Root CA..." under "Issued By": + +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the certificates below are not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. + +Issued To: DoD Root CA 2 +Issued By: DoD Interoperability Root CA 1 +Thumbprint: 22BBE981F0694D246CC1472ED2B021DC8540A22F +Valid to: Friday, September 6, 2019 + +Issued To: DoD Root CA 3 +Issued By: DoD Interoperability Root CA 2 +Thumbprint: FFAD03329B9E527A43EEC66A56F9CBB5393E6E13 +Valid to: Sunday, September 23, 2018 + +Issued To: DoD Root CA 3 +Issued By: DoD Interoperability Root CA 2 +Thumbprint: FCE1B1E25374DD94F5935BEB86CA643D8C8D1FF4 +Valid to: Sunday, February 17, 2019 + + + <VulnDiscussion>To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems. + +Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + This is applicable to unclassified systems. It is NA for others. + +Open "PowerShell" as an administrator. + +Execute the following command: + +Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, Issuer, Thumbprint, NotAfter + +If the following certificate "Subject", "Issuer", and "Thumbprint" information is not displayed, this is a finding. + +If an expired certificate ("NotAfter" date) is not listed in the results, this is not a finding. + +Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=US DoD CCEB Interoperability Root CA 1, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: DA36FAF56B2F6FBA1604F5BE46D864C9FA013BA3 +NotAfter: 3/9/2019 + +Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US +Issuer: CN=US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US +Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E +NotAfter: 9/27/2019 + +Alternately, use the Certificates MMC snap-in: + +Run "MMC". + +Select "File", "Add/Remove Snap-in". + +Select "Certificates" and click "Add". + +Select "Computer account" and click "Next". + +Select "Local computer: (the computer this console is running on)" and click "Finish". + +Click "OK". + +Expand "Certificates" and navigate to "Untrusted Certificates >> Certificates". + +For each certificate with "US DoD CCEB Interoperability Root CA ..." under "Issued By": + +Right-click on the certificate and select "Open". + +Select the "Details" Tab. + +Scroll to the bottom and select "Thumbprint". + +If the certificate below is not listed or the value for the "Thumbprint" field is not as noted, this is a finding. + +If an expired certificate ("Valid to" date) is not listed in the results, this is not a finding. + +Issued To: DoD Root CA 2 +Issued By: US DoD CCEB Interoperability Root CA 1 +Thumbprint: DA36FAF56B2F6FBA1604F5BE46D864C9FA013BA3 +Valid to: Saturday, March 9, 2019 + +Issued To: DoD Root CA 3 +Issuer by: US DoD CCEB Interoperability Root CA 2 +Thumbprint: 929BF3196896994C0A201DF4A5B71F603FEFBF2E +Valid: Friday, September 27, 2019 + + + <VulnDiscussion>This requirement addresses protection of user-generated data as well as operating system-specific configuration data. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate, in accordance with the security category and/or classification of the information. + +Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields). + +Satisfies: SRG-OS-000185-GPOS-00079, SRG-OS-000404-GPOS-00183, SRG-OS-000405-GPOS-00184</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Verify systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data employ encryption to protect the confidentiality and integrity of all information at rest. + +If they do not, this is a finding. + + + <VulnDiscussion>Shares on a system provide network access. To prevent exposing sensitive information, where shares are necessary, permissions must be reconfigured to give the minimum access to accounts that require it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If only system-created shares such as "ADMIN$", "C$", and "IPC$" exist on the system, this is NA. (System-created shares will display a message that it has been shared for administrative purposes when "Properties" is selected.) + +Run "Computer Management". + +Navigate to System Tools >> Shared Folders >> Shares. + +Right-click any non-system-created shares. + +Select "Properties". + +Select the "Share Permissions" tab. + +If the file shares have not been configured to restrict permissions to the specific groups or accounts that require access, this is a finding. + +Select the "Security" tab. + +If the permissions have not been configured to restrict permissions to the specific groups or accounts that require access, this is a finding. + + + <VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. + +Ensuring the confidentiality of transmitted information requires the operating system to take measures in preparing information for transmission. This can be accomplished via access control and encryption. + +Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, operating systems need to support transmission protection mechanisms such as TLS, encrypted VPNs, or IPsec. + +Satisfies: SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + If the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, verify protection methods such as TLS, encrypted VPNs, or IPsec have been implemented. + +If protection methods have not been implemented, this is a finding. + + + <VulnDiscussion>Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups. If the account or group objects are reanimated, there is a potential they may still have rights no longer intended. Valid domain accounts or groups may also show up as unresolved SIDs if a connection to the domain cannot be established for some reason.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the effective User Rights setting in Local Group Policy Editor. +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format that begins with "*S-1-".) + +If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding. + + + + + + + + + + + SYSTEM + False + This folder subfolders and files + FullControl + + + + + Administrators + False + This folder subfolders and files + FullControl + + + + + Users + False + This folder subfolders and files + ReadAndExecute + + + + + Users + False + This folder and subfolders + CreateDirectories,AppendData + + + + + Users + False + Subfolders only + CreateFiles,WriteData + + + + + CREATOR OWNER + False + Subfolders and files only + FullControl + + + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + +The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %SystemDrive%\ + The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Review the permissions for the system drive's root directory (usually C:\). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions except where noted as defaults. Individual accounts must not be used to assign permissions. + +If permissions are not as restrictive as the default permissions listed below, this is a finding. + +Viewing in File Explorer: + +View the Properties of the system drive's root directory. + +Select the "Security" tab, and the "Advanced" button. + +Default permissions: +C:\ +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +SYSTEM - Full control - This folder, subfolders, and files +Administrators - Full control - This folder, subfolders, and files +Users - Read & execute - This folder, subfolders, and files +Users - Create folders/append data - This folder and subfolders +Users - Create files/write data - Subfolders only +CREATOR OWNER - Full Control - Subfolders and files only + +Alternately, use icacls: + +Open "Command Prompt (Admin)". + +Enter "icacls" followed by the directory: + +"icacls c:\" + +The following results should be displayed: + +c:\ +NT AUTHORITY\SYSTEM:(OI)(CI)(F) +BUILTIN\Administrators:(OI)(CI)(F) +BUILTIN\Users:(OI)(CI)(RX) +BUILTIN\Users:(CI)(AD) +BUILTIN\Users:(CI)(IO)(WD) +CREATOR OWNER:(OI)(CI)(IO)(F) +Successfully processed 1 files; Failed processing 0 files + + + + + + + TrustedInstaller + False + This folder and subfolders + FullControl + + + + + SYSTEM + False + This folder only + Modify + + + + + SYSTEM + False + Subfolders and files only + FullControl + + + + + Administrators + False + This folder only + Modify + + + + + Administrators + False + Subfolders and files only + FullControl + + + + + Users + False + This folder subfolders and files + ReadAndExecute + + + + + CREATOR OWNER + False + Subfolders and files only + FullControl + + + + + ALL APPLICATION PACKAGES + False + This folder subfolders and files + ReadAndExecute + + + + + ALL RESTRICTED APPLICATION PACKAGES + False + This folder subfolders and files + ReadAndExecute + + + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + +The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %ProgramFiles(x86)% + The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). +Review the permissions for the program file directories (Program Files and Program Files [x86]). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. Individual accounts must not be used to assign permissions. +If permissions are not as restrictive as the default permissions listed below, this is a finding. +Viewing in File Explorer: +For each folder, view the Properties. +Select the "Security" tab, and the "Advanced" button. +Default permissions: +\Program Files (x86) +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +Alternately, use icacls: +Open a Command prompt (admin). +Enter "icacls" followed by the directory: +'icacls "c:\program files"' +'icacls "c:\program files (x86)"' +The following results should be displayed for each when entered: +c:\program files (c:\program files (x86)) +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 files + + + + + + + + TrustedInstaller + False + This folder and subfolders + FullControl + + + + + SYSTEM + False + This folder only + Modify + + + + + SYSTEM + False + Subfolders and files only + FullControl + + + + + Administrators + False + This folder only + Modify + + + + + Administrators + False + Subfolders and files only + FullControl + + + + + Users + False + This folder subfolders and files + ReadAndExecute + + + + + CREATOR OWNER + False + Subfolders and files only + FullControl + + + + + ALL APPLICATION PACKAGES + False + This folder subfolders and files + ReadAndExecute + + + + + ALL RESTRICTED APPLICATION PACKAGES + False + This folder subfolders and files + ReadAndExecute + + + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + +The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %ProgramFiles% + The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). +Review the permissions for the program file directories (Program Files and Program Files [x86]). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. Individual accounts must not be used to assign permissions. +If permissions are not as restrictive as the default permissions listed below, this is a finding. +Viewing in File Explorer: +For each folder, view the Properties. +Select the "Security" tab, and the "Advanced" button. +Default permissions: +\Program Files +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +Alternately, use icacls: +Open a Command prompt (admin). +Enter "icacls" followed by the directory: +'icacls "c:\program files"' +'icacls "c:\program files (x86)"' +The following results should be displayed for each when entered: +c:\program files (c:\program files (x86)) +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 files + + + + + + + + TrustedInstaller + False + This folder and subfolders + FullControl + + + + + SYSTEM + False + This folder only + Modify + + + + + SYSTEM + False + Subfolders and files only + FullControl + + + + + Administrators + False + This folder only + Modify + + + + + Administrators + False + Subfolders and files only + FullControl + + + + + Users + False + This folder subfolders and files + ReadAndExecute + + + + + CREATOR OWNER + False + Subfolders and files only + FullControl + + + + + ALL APPLICATION PACKAGES + False + This folder subfolders and files + ReadAndExecute + + + + + ALL RESTRICTED APPLICATION PACKAGES + False + This folder subfolders and files + ReadAndExecute + + + <VulnDiscussion>Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. + +The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %windir% + The default permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN19-SO-000240). + +Review the permissions for the Windows installation directory (usually C:\Windows). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. Individual accounts must not be used to assign permissions. + +If permissions are not as restrictive as the default permissions listed below, this is a finding: + +Viewing in File Explorer: + +For each folder, view the Properties. + +Select the "Security" tab and the "Advanced" button. + +Default permissions: +\Windows +Type - "Allow" for all +Inherited from - "None" for all + +Principal - Access - Applies to + +TrustedInstaller - Full control - This folder and subfolders +SYSTEM - Modify - This folder only +SYSTEM - Full control - Subfolders and files only +Administrators - Modify - This folder only +Administrators - Full control - Subfolders and files only +Users - Read & execute - This folder, subfolders, and files +CREATOR OWNER - Full control - Subfolders and files only +ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files +ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files + +Alternately, use icacls: + +Open a Command prompt (admin). + +Enter "icacls" followed by the directory: + +"icacls c:\windows" + +The following results should be displayed for each when entered: + +c:\windows +NT SERVICE\TrustedInstaller:(F) +NT SERVICE\TrustedInstaller:(CI)(IO)(F) +NT AUTHORITY\SYSTEM:(M) +NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) +BUILTIN\Administrators:(M) +BUILTIN\Administrators:(OI)(CI)(IO)(F) +BUILTIN\Users:(RX) +BUILTIN\Users:(OI)(CI)(IO)(GR,GE) +CREATOR OWNER:(OI)(CI)(IO)(F) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX) +APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) +Successfully processed 1 files; Failed processing 0 files + + + + + + + SYSTEM + False + This Key and Subkeys + FullControl + + + <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + HKLM:\SECURITY + Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. +If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. +If permissions are not as restrictive as the default permissions listed below, this is a finding: +Run "Regedit". +Right-click on the registry areas noted below. +Select "Permissions" and the "Advanced" button. +HKEY_LOCAL_MACHINE\SECURITY +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +SYSTEM - Full Control - This key and subkeys +Administrators - Special - This key and subkeys +Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. +Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in Windows Server 2019 to the following SID, this is currently not a finding. +S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681 +If the defaults have not been changed, these are not a finding. + + + + + + + + Users + False + This Key and Subkeys + ReadKey + + + + + Administrators + False + This Key and Subkeys + FullControl + + + + + SYSTEM + False + This Key and Subkeys + FullControl + + + + + CREATOR OWNER + False + This Key and Subkeys + FullControl + + + + + ALL APPLICATION PACKAGES + False + This Key and Subkeys + ReadKey + + + <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + HKLM:\SOFTWARE + Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. +If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. +If permissions are not as restrictive as the default permissions listed below, this is a finding: +Run "Regedit". +Right-click on the registry areas noted below. +Select "Permissions" and the "Advanced" button. +HKEY_LOCAL_MACHINE\SOFTWARE +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +Users - Read - This key and subkeys +Administrators - Full Control - This key and subkeys +SYSTEM - Full Control - This key and subkeys +CREATOR OWNER - Full Control - This key and subkeys +ALL APPLICATION PACKAGES - Read - This key and subkeys +Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. +Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in Windows Server 2019 to the following SID, this is currently not a finding. +S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681 +If the defaults have not been changed, these are not a finding. + + + + + + + + Users + False + This Key and Subkeys + ReadKey + + + + + Administrators + False + This Key and Subkeys + FullControl + + + + + SYSTEM + False + This Key and Subkeys + FullControl + + + + + CREATOR OWNER + False + Subkeys Only + FullControl + + + + + ALL APPLICATION PACKAGES + False + This Key and Subkeys + ReadKey + + + <VulnDiscussion>The registry is integral to the function, security, and stability of the Windows system. Changing the system's registry permissions allows the possibility of unauthorized and anonymous modification to the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + HKLM:\SYSTEM + Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below. +If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding. +If permissions are not as restrictive as the default permissions listed below, this is a finding: +Run "Regedit". +Right-click on the registry areas noted below. +Select "Permissions" and the "Advanced" button. +HKEY_LOCAL_MACHINE\SYSTEM +Type - "Allow" for all +Inherited from - "None" for all +Principal - Access - Applies to +Users - Read - This key and subkeys +Administrators - Full Control - This key and subkeys +SYSTEM - Full Control - This key and subkeys +CREATOR OWNER - Full Control - Subkeys only +ALL APPLICATION PACKAGES - Read - This key and subkeys +Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission. +Microsoft has given Read permission to the SOFTWARE and SYSTEM registry keys in Windows Server 2019 to the following SID, this is currently not a finding. +S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681 +If the defaults have not been changed, these are not a finding. + + + + + + + + Eventlog + False + + + FullControl + + + + + SYSTEM + False + + + FullControl + + + + + Administrators + False + + + FullControl + + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Application event log may be susceptible to tampering if proper permissions are not applied. + +Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %windir%\SYSTEM32\WINEVT\LOGS\Application.evtx + Navigate to the Application event log file. + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. + +If the permissions for the "Application.evtx" file are not as restrictive as the default permissions listed below, this is a finding: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + + + + + + + Eventlog + False + + + FullControl + + + + + SYSTEM + False + + + FullControl + + + + + Administrators + False + + + FullControl + + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The Security event log may disclose sensitive information or be susceptible to tampering if proper permissions are not applied. + +Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %windir%\SYSTEM32\WINEVT\LOGS\Security.evtx + Navigate to the Security event log file. + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. + +If the permissions for the "Security.evtx" file are not as restrictive as the default permissions listed below, this is a finding: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + + + + + + + Eventlog + False + + + FullControl + + + + + SYSTEM + False + + + FullControl + + + + + Administrators + False + + + FullControl + + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. The System event log may be susceptible to tampering if proper permissions are not applied. + +Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %windir%\SYSTEM32\WINEVT\LOGS\System.evtx + Navigate to the System event log file. + +The default location is the "%SystemRoot%\System32\winevt\Logs" folder. However, the logs may have been moved to another folder. + +If the permissions for the "System.evtx" file are not as restrictive as the default permissions listed below, this is a finding: + +Eventlog - Full Control +SYSTEM - Full Control +Administrators - Full Control + + + + + + + TrustedInstaller + False + + + FullControl + + + + + Administrators + False + + + ReadAndExecute + + + + + SYSTEM + False + + + ReadAndExecute + + + + + Users + False + + + ReadAndExecute + + + + + ALL APPLICATION PACKAGES + False + + + ReadAndExecute + + + + + ALL RESTRICTED APPLICATION PACKAGES + False + + + ReadAndExecute + + + <VulnDiscussion>Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information. + +Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order to make access decisions regarding the modification or deletion of audit tools. + +Satisfies: SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + True + False + False + + %windir%\SYSTEM32\eventvwr.exe + Navigate to "%SystemRoot%\System32". + +View the permissions on "Eventvwr.exe". + +If any groups or accounts other than TrustedInstaller have "Full control" or "Modify" permissions, this is a finding. + +The default permissions below satisfy this requirement: + +TrustedInstaller - Full Control +Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES, ALL RESTRICTED APPLICATION PACKAGES - Read & Execute + + + + + <VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Data Execution Prevention (DEP)", are enabled by default at the system level. DEP prevents code from being run from data-only memory pages. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP + False + System + False + + This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "DEP: Enable" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration) + + + <VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Control flow guard (CFG)", are enabled by default at the system level. CFG ensures flow integrity for indirect calls. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + CFG + False + System + False + + This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "CFG: Enable" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration) + + + <VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Validate exception chains (SEHOP)", are enabled by default at the system level. SEHOP (structured exception handling overwrite protection) ensures the integrity of an exception chain during exception dispatch. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + SEHOP + False + System + False + + This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "SEHOP: Enable" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration) + + + <VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Validate heap integrity", are enabled by default at the system level. "Validate heap integrity" terminates a process when heap corruption is detected. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + TerminateOnError + False + System + False + + This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "Heap: TerminateOnError" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration) + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,BottomUp,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + Acrobat.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name Acrobat.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,BottomUp,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + AcroRd32.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name AcroRd32.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP + False + chrome.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name chrome.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + EXCEL.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name EXCEL.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,BottomUp,ForceRelocateImages + False + firefox.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name firefox.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,BlockRemoteImageLoads,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec,DisallowChildProcessCreation + False + FLTLDR.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name FLTLDR.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Child Process: +DisallowChildProcessCreation: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,BlockRemoteImageLoads,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec,DisallowChildProcessCreation + False + GROOVE.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name GROOVE.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +Child Process: +DisallowChildProcessCreation: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,BottomUp,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + iexplore.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name iexplore.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +BottomUp: ON +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + INFOPATH.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name INFOPATH.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + java.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name [application name]" with each of the following substituted for [application name]: +java.exe, javaw.exe, and javaws.exe +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON" for each, this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + javaw.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name [application name]" with each of the following substituted for [application name]: +java.exe, javaw.exe, and javaws.exe +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON" for each, this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + javaws.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name [application name]" with each of the following substituted for [application name]: +java.exe, javaw.exe, and javaws.exe +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON" for each, this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + lync.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name lync.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + MSACCESS.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name MSACCESS.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + MSPUB.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name MSPUB.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + OIS.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name OIS.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,BlockRemoteImageLoads,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + OneDrive.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name OneDrive.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +ImageLoad: +BlockRemoteImageLoads: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + OUTLOOK.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name OUTLOOK.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + plugin-container.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name plugin-container.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + POWERPNT.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name POWERPNT.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + PPTVIEW.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name PPTVIEW.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + VISIO.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name VISIO.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + VPREVIEW.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name VPREVIEW.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,ForceRelocateImages,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + WINWORD.EXE + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name WINWORD.EXE". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +ASLR: +ForceRelocateImages: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + wmplayer.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name wmplayer.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +Payload: +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection provides a means of enabling additional mitigations against potential threats at the system and application level. Without these additional application protections, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + DEP,EnableExportAddressFilter,EnableExportAddressFilterPlus,EnableImportAddressFilter,EnableRopStackPivot,EnableRopCallerCheck,EnableRopSimExec + False + wordpad.exe + False + + If the referenced application is not installed on the system, this is NA. + +This is applicable to unclassified systems, for other systems this is NA. + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -Name wordpad.exe". +(Get-ProcessMitigation can be run without the -Name parameter to get a list of all application mitigations configured.) + +If the following mitigations do not have a status of "ON", this is a finding: + +DEP: +Enable: ON + +Payload: +EnableExportAddressFilter: ON +EnableExportAddressFilterPlus: ON +EnableImportAddressFilter: ON +EnableRopStackPivot: ON +EnableRopCallerCheck: ON +EnableRopSimExec: ON + +The PowerShell command produces a list of mitigations; only those with a required status of "ON" are listed here. + + + <VulnDiscussion>Exploit protection enables mitigations against potential threats at the system and application level. Several mitigations, including "Randomize memory allocations (Bottom-Up ASLR)", are enabled by default at the system level. Bottom-Up ASLR (address space layout randomization) randomizes locations for virtual memory allocations, including those for system structures. If this is turned off, Windows may be subject to various exploits.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + + BottomUp + False + System + False + + This is applicable to unclassified systems, for other systems this is NA. + +The default configuration in Exploit Protection is "On by default" which meets this requirement. The PowerShell query results for this show as "NOTSET". + +Run "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-ProcessMitigation -System". + +If the status of "ASLR: BottomUp" is "OFF", this is a finding. + +Values that would not be a finding include: + +ON +NOTSET (Default configuration) + + + + + <VulnDiscussion>Unattended systems are susceptible to unauthorized use and should be locked when unattended. The screen saver should be set at a maximum of 15 minutes and be password protected. This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer. + +Satisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + True + '{0}' -le '900' -and '{0}' -gt '0' + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: InactivityTimeoutSecs + +Value Type: REG_DWORD +Value: 0x00000384 (900) (or less, excluding "0" which is effectively disabled) + + InactivityTimeoutSecs + Dword + + + <VulnDiscussion>Allowing unsecure RPC communication exposes the system to man-in-the-middle attacks and data disclosure attacks. A man-in-the-middle attack occurs when an intruder captures packets between a client and server and modifies them before allowing the packets to be exchanged. Usually the attacker will modify the information in the packets in an attempt to cause either the client or server to reveal sensitive information. + +Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000250-GPOS-00093</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fEncryptRPCTraffic + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + fEncryptRPCTraffic + Dword + + + <VulnDiscussion>Remote connections must be encrypted to prevent interception of data or sensitive information. Selecting "High Level" will ensure encryption of Remote Desktop Services sessions in both directions. + +Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000250-GPOS-00093</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: MinEncryptionLevel + +Type: REG_DWORD +Value: 0x00000003 (3) + 3 + MinEncryptionLevel + Dword + + + <VulnDiscussion>The Windows SAM stores users' passwords. Restricting Remote Procedure Call (RPC) connections to the SAM to Administrators helps protect those credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + False + + This applies to member servers and standalone systems; it is NA for domain controllers. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: RestrictRemoteSAM + +Value Type: REG_SZ +Value: O:BAG:BAD:(A;;RC;;;BA) + O:BAG:BAD:(A;;RC;;;BA) + RestrictRemoteSAM + String + + + <VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. + +Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: LegalNoticeText + +Value Type: REG_SZ +Value: See message text below + +You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. + +By using this IS (which includes any device attached to this IS), you consent to the following conditions: + +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. + +-At any time, the USG may inspect and seize data stored on this IS. + +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. + +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. + +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. + You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. + +By using this IS (which includes any device attached to this IS), you consent to the following conditions: + +-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. + +-At any time, the USG may inspect and seize data stored on this IS. + +-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. + +-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. + +-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. + LegalNoticeText + String + + + <VulnDiscussion>Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. + +Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000228-GPOS-00088</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + True + '{0}' -match '^(DoD Notice and Consent Banner|US Department of Defense Warning Statement)$' + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: LegalNoticeCaption + +Value Type: REG_SZ +Value: See message title options below + +"DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or an organization-defined equivalent. + +If an organization-defined title is used, it can in no case contravene or modify the language of the banner text required in WN19-SO-000150. + +Automated tools may only search for the titles defined above. If an organization-defined title is used, a manual review will be required. + + LegalNoticeCaption + String + + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. +This setting allows administrators to enable more precise auditing capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: SCENoApplyLegacyAuditPolicy + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + SCENoApplyLegacyAuditPolicy + Dword + + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Enabling "Include command line data for process creation events" will record the command line information with the process creation events in the log. This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit\ + +Value Name: ProcessCreationIncludeCmdLine_Enabled + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + ProcessCreationIncludeCmdLine_Enabled + Dword + + + <VulnDiscussion>Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. + +Enabling PowerShell script block logging will record detailed information from the processing of PowerShell commands and scripts. This can provide additional detail when malware has run on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\ Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\ + +Value Name: EnableScriptBlockLogging + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + EnableScriptBlockLogging + Dword + + + <VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application + True + '{0}' -ge '32768' + If the system is configured to write events directly to an audit server, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Application\ + +Value Name: MaxSize + +Type: REG_DWORD +Value: 0x00008000 (32768) (or greater) + + MaxSize + Dword + + + <VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security + True + '{0}' -ge '196608' + If the system is configured to write events directly to an audit server, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\Security\ + +Value Name: MaxSize + +Type: REG_DWORD +Value: 0x00030000 (196608) (or greater) + + MaxSize + Dword + + + <VulnDiscussion>Inadequate log size will cause the log to fill up quickly. This may prevent audit events from being recorded properly and require frequent attention by administrative personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\System + True + '{0}' -ge '32768' + If the system is configured to write events directly to an audit server, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\EventLog\System\ + +Value Name: MaxSize + +Type: REG_DWORD +Value: 0x00008000 (32768) (or greater) + + MaxSize + Dword + + + <VulnDiscussion>Installation options for applications are typically controlled by administrators. This setting prevents users from changing installation options that may bypass security features.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ + +Value Name: EnableUserControl + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + EnableUserControl + Dword + + + <VulnDiscussion>Standard user accounts must not be granted elevated privileges. Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ + +Value Name: AlwaysInstallElevated + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AlwaysInstallElevated + Dword + + + <VulnDiscussion>Configuring the system to disable IPv6 source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\ + +Value Name: DisableIPSourceRouting + +Type: REG_DWORD +Value: 0x00000002 (2) + 2 + DisableIPSourceRouting + Dword + + + <VulnDiscussion>Configuring the system to disable IP source routing protects against spoofing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ + +Value Name: DisableIPSourceRouting + +Value Type: REG_DWORD +Value: 0x00000002 (2) + 2 + DisableIPSourceRouting + Dword + + + <VulnDiscussion>Allowing ICMP redirect of routes can lead to traffic not being routed properly. When disabled, this forces ICMP to be routed via the shortest path first.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ + +Value Name: EnableICMPRedirect + +Value Type: REG_DWORD +Value: 0x00000000 (0) + 0 + EnableICMPRedirect + Dword + + + <VulnDiscussion>Insecure guest logons allow unauthenticated access to shared folders. Shared resources on a system must require authentication to establish proper access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation\ + +Value Name: AllowInsecureGuestAuth + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AllowInsecureGuestAuth + Dword + + + <VulnDiscussion>Additional security requirements are applied to UNC paths specified in hardened UNC paths before allowing access to them. This aids in preventing tampering with or spoofing of connections to these paths.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\ +Value Type: REG_SZ +Value Name: \\*\NETLOGON +Value: RequireMutualAuthentication=1, RequireIntegrity=1 + RequireMutualAuthentication=1, RequireIntegrity=1 + \\*\NETLOGON + String + + + <VulnDiscussion>Additional security requirements are applied to UNC paths specified in hardened UNC paths before allowing access to them. This aids in preventing tampering with or spoofing of connections to these paths.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths\ +Value Type: REG_SZ +Value Name: \\*\SYSVOL +Value: RequireMutualAuthentication=1, RequireIntegrity=1 + RequireMutualAuthentication=1, RequireIntegrity=1 + \\*\SYSVOL + String + + + <VulnDiscussion>An exportable version of credentials is provided to remote hosts when using credential delegation which exposes them to theft on the remote host. Restricted Admin mode or Remote Credential Guard allow delegation of non-exportable credentials providing additional protection of the credentials. Enabling this configures the host to support Restricted Admin mode or Remote Credential Guard.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\ + +Value Name: AllowProtectedCreds + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + AllowProtectedCreds + Dword + + + <VulnDiscussion>Virtualization Based Security (VBS) provides the platform for the additional security features Credential Guard and virtualization-based protection of code integrity. Secure Boot is the minimum security level, with DMA protection providing additional memory protection. DMA Protection requires a CPU that supports input/output memory management unit (IOMMU).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard + False + + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ +Value Type: REG_DWORD +Value Name: EnableVirtualizationBasedSecurity +Value: 0x00000001 (1) + 1 + EnableVirtualizationBasedSecurity + Dword + + + <VulnDiscussion>Virtualization Based Security (VBS) provides the platform for the additional security features Credential Guard and virtualization-based protection of code integrity. Secure Boot is the minimum security level, with DMA protection providing additional memory protection. DMA Protection requires a CPU that supports input/output memory management unit (IOMMU).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard + True + '{0}' -match '1|3' + Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ +Value Type: REG_DWORD +Value Name: RequirePlatformSecurityFeatures +Value: 0x00000001 (1) (Secure Boot only) or 0x00000003 (3) (Secure Boot and DMA Protection) + + RequirePlatformSecurityFeatures + Dword + + + <VulnDiscussion>Compromised boot drivers can introduce malware prior to protection mechanisms that load after initialization. The Early Launch Antimalware driver can limit allowed drivers based on classifications determined by the malware protection application. At a minimum, drivers determined to be bad must not be allowed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\EarlyLaunch + True + '{0}' -match '1|3|8|ShouldBeAbsent' + The default behavior is for Early Launch Antimalware - Boot-Start Driver Initialization policy to enforce "Good, unknown and bad but critical" (preventing "bad"). + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0x00000007 (7)", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Policies\EarlyLaunch\ + +Value Name: DriverLoadPolicy + +Value Type: REG_DWORD +Value: 0x00000001 (1), 0x00000003 (3), or 0x00000008 (8) (or if the Value Name does not exist) + +Possible values for this setting are: +8 - Good only +1 - Good and unknown +3 - Good, unknown and bad but critical +7 - All (which includes "bad" and would be a finding) + + DriverLoadPolicy + Dword + + + <VulnDiscussion>Registry entries for group policy settings can potentially be changed from the required configuration. This could occur as part of troubleshooting or by a malicious process on a compromised system. Enabling this setting and then selecting the "Process even if the Group Policy objects have not changed" option ensures the policies will be reprocessed even if none have been changed. This way, any unauthorized changes are forced to match the domain-based group policy settings again.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2} + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\ + +Value Name: NoGPOListChanges + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + NoGPOListChanges + Dword + + + <VulnDiscussion>A system that does not require authentication when resuming from sleep may provide access to unauthorized users. Authentication must always be required when accessing a system. This setting ensures users are prompted for a password when the system wakes from sleep (on battery).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51 + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ + +Value Name: DCSettingIndex + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DCSettingIndex + Dword + + + <VulnDiscussion>A system that does not require authentication when resuming from sleep may provide access to unauthorized users. Authentication must always be required when accessing a system. This setting ensures users are prompted for a password when the system wakes from sleep (plugged in).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51 + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\ + +Value Name: ACSettingIndex + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + ACSettingIndex + Dword + + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Limiting this capability will prevent potentially sensitive information from being sent outside the enterprise. The "Security" option for Telemetry configures the lowest amount of data, effectively none outside of the Malicious Software Removal Tool (MSRT), Defender, and telemetry client settings. "Basic" sends basic diagnostic and usage data and may be required to support some Microsoft services.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection + True + '{0}' -match '0|1' + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DataCollection\ + +Value Name: AllowTelemetry + +Type: REG_DWORD +Value: 0x00000000 (0) (Security), 0x00000001 (1) (Basic) + + AllowTelemetry + Dword + + + <VulnDiscussion>Windows Update can obtain updates from additional sources instead of Microsoft. In addition to Microsoft, updates can be obtained from and sent to PCs on the local network as well as on the Internet. This is part of the Windows Update trusted process, however to minimize outside exposure, obtaining updates from or sending to systems on the Internet must be prevented.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization + True + '{0}' -match '0|1|2|99|100' + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\ + +Value Name: DODownloadMode + +Value Type: REG_DWORD +Value: 0x00000000 (0) - No peering (HTTP Only) +0x00000001 (1) - Peers on same NAT only (LAN) +0x00000002 (2) - Local Network / Private group peering (Group) +0x00000063 (99) - Simple download mode, no peering (Simple) +0x00000064 (100) - Bypass mode, Delivery Optimization not used (Bypass) + +A value of 0x00000003 (3), Internet, is a finding. + + DODownloadMode + Dword + + + <VulnDiscussion>Legacy plug-in applications may continue to function when a File Explorer session has become corrupt. Disabling this feature will prevent this.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer + False + + The default behavior is for File Explorer heap termination on corruption to be enabled. + +If the registry Value Name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0x00000000 (0) (or if the Value Name does not exist)", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ + +Value Name: NoHeapTerminationOnCorruption + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist) + 0 + NoHeapTerminationOnCorruption + Dword + + + <VulnDiscussion>The shell protocol will limit the set of folders that applications can open when run in protected mode. Restricting files an application can open to a limited set of folders increases the security of Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + False + + The default behavior is for shell protected mode to be turned on for File Explorer. + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0x00000000 (0) (or if the Value Name does not exist)", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ + +Value Name: PreXPSP2ShellProtocolBehavior + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist) + 0 + PreXPSP2ShellProtocolBehavior + Dword + + + <VulnDiscussion>Attachments from RSS feeds may not be secure. This setting will prevent attachments from being downloaded from RSS feeds.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds\ + +Value Name: DisableEnclosureDownload + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DisableEnclosureDownload + Dword + + + <VulnDiscussion>Web-based programs may attempt to install malicious software on a system. Ensuring users are notified if a web-based program attempts to install software allows them to refuse the installation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer + False + + The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system. + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0x00000000 (0) (or if the Value Name does not exist)", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ + +Value Name: SafeForScripting + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist) + 0 + SafeForScripting + Dword + + + <VulnDiscussion>Windows can be configured to automatically sign the user back in after a Windows Update restart. Some protections are in place to help ensure this is done in a secure fashion; however, disabling this will prevent the caching of credentials for this purpose and also ensure the user is aware of the restart.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: DisableAutomaticRestartSignOn + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DisableAutomaticRestartSignOn + Dword + + + <VulnDiscussion>The default Windows configuration caches the last logon credentials for users who log on interactively to a system. This feature is provided for system availability reasons, such as the user's machine being disconnected from the network or domain controllers being unavailable. Even though the credential cache is well protected, if a system is attacked, an unauthorized individual may isolate the password to a domain user account using a password-cracking program and gain access to the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon + True + '{0}' -le '4' + This applies to member servers. For domain controllers and standalone systems, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ + +Value Name: CachedLogonsCount + +Value Type: REG_SZ +Value: 4 (or less) + + CachedLogonsCount + String + + + <VulnDiscussion>Credential Guard uses virtualization-based security to protect data that could be used in credential theft attacks if compromised. This authentication information, which was stored in the Local Security Authority (LSA) in previous versions of Windows, is isolated from the rest of operating system and can only be accessed by privileged system software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard + False + + For domain controllers and standalone systems, this is NA. + +Current hardware and virtual environments may not support virtualization-based security features, including Credential Guard, due to specific supporting requirements, including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within a virtual machine. + +Open "PowerShell" with elevated privileges (run as administrator). + +Enter the following: + +"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard" + +If "SecurityServicesRunning" does not include a value of "1" (e.g., "{1, 2}"), this is a finding. + +Alternately: + +Run "System Information". + +Under "System Summary", verify the following: + +If "Device Guard Security Services Running" does not list "Credential Guard", this is a finding. + +The policy settings referenced in the Fix section will configure the following registry value. However, due to hardware requirements, the registry value alone does not ensure proper function. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ + +Value Name: LsaCfgFlags +Value Type: REG_DWORD +Value: 0x00000001 (1) (Enabled with UEFI lock) + +A Microsoft article on Credential Guard system requirement can be found at the following link: + +https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-requirements + 1 + LsaCfgFlags + Dword + + + <VulnDiscussion>An account without a password can allow unauthorized access to a system as only the username would be required. Password policies should prevent accounts with blank passwords from existing on a system. However, if a local account with a blank password does exist, enabling this setting will prevent network access, limiting the account to local console logon only.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: LimitBlankPasswordUse + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + LimitBlankPasswordUse + Dword + + + <VulnDiscussion>Computer account passwords are changed automatically on a regular basis. This setting controls the maximum password age that a machine account may have. This must be set to no more than 30 days, ensuring the machine changes its password monthly.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + True + '{0}' -le '30' -and '{0}' -gt '0' + This is the default configuration for this setting (30 days). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: MaximumPasswordAge + +Value Type: REG_DWORD +Value: 0x0000001e (30) (or less, but not 0) + + MaximumPasswordAge + Dword + + + <VulnDiscussion>Unattended systems are susceptible to unauthorized use and must be locked. Configuring a system to lock when a smart card is removed will ensure the system is inaccessible when unattended.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon + True + '{0}' -match '1|2' + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ + +Value Name: scremoveoption + +Value Type: REG_SZ +Value: 1 (Lock Workstation) or 2 (Force Logoff) + +If configuring this on servers causes issues, such as terminating users' remote sessions, and the organization has a policy in place that any other sessions on the servers, such as administrative console logons, are manually locked or logged off when unattended or not in use, this would be acceptable. This must be documented with the ISSO. + + scremoveoption + String + + + <VulnDiscussion>Anonymous enumeration of SAM accounts allows anonymous logon users (null session connections) to list all accounts names, thus providing a list of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: RestrictAnonymousSAM + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + RestrictAnonymousSAM + Dword + + + <VulnDiscussion>Access by anonymous users must be restricted. If this setting is enabled, anonymous users have the same rights and permissions as the built-in Everyone group. Anonymous users must not have these permissions or rights.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: EveryoneIncludesAnonymous + +Value Type: REG_DWORD +Value: 0x00000000 (0) + 0 + EveryoneIncludesAnonymous + Dword + + + <VulnDiscussion>Services using Local System that use Negotiate when reverting to NTLM authentication may gain unauthorized access if allowed to authenticate anonymously versus using the computer identity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\ + +Value Name: UseMachineId + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + UseMachineId + Dword + + + <VulnDiscussion>NTLM sessions that are allowed to fall back to Null (unauthenticated) sessions may gain unauthorized access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\MSV1_0 + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\MSV1_0\ + +Value Name: allownullsessionfallback + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + allownullsessionfallback + Dword + + + <VulnDiscussion>PKU2U is a peer-to-peer authentication protocol. This setting prevents online identities from authenticating to domain-joined systems. Authentication will be centrally managed with Windows user accounts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\pku2u + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\LSA\pku2u\ + +Value Name: AllowOnlineID + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AllowOnlineID + Dword + + + <VulnDiscussion>The Kerberos v5 authentication protocol is the default for authentication of users who are logging on to domain accounts. NTLM, which is less secure, is retained in later Windows versions for compatibility with clients and servers that are running earlier versions of Windows or applications that still use it. It is also used to authenticate logons to standalone computers that are running later versions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: LmCompatibilityLevel + +Value Type: REG_DWORD +Value: 0x00000005 (5) + 5 + LmCompatibilityLevel + Dword + + + <VulnDiscussion>This setting controls the signing requirements for LDAP clients. This must be set to "Negotiate signing" or "Require signing", depending on the environment and type of LDAP server in use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LDAP + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LDAP\ + +Value Name: LDAPClientIntegrity + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + LDAPClientIntegrity + Dword + + + <VulnDiscussion>Microsoft has implemented a variety of security support providers for use with Remote Procedure Call (RPC) sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ + +Value Name: NTLMMinClientSec + +Value Type: REG_DWORD +Value: 0x20080000 (537395200) + 537395200 + NTLMMinClientSec + Dword + + + <VulnDiscussion>Microsoft has implemented a variety of security support providers for use with Remote Procedure Call (RPC) sessions. All of the options must be enabled to ensure the maximum security level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0\ + +Value Name: NTLMMinServerSec + +Value Type: REG_DWORD +Value: 0x20080000 (537395200) + 537395200 + NTLMMinServerSec + Dword + + + <VulnDiscussion>Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default Discretionary Access Control List (DACL) that specifies who can access the objects with what permissions. When this policy is enabled, the default DACL is stronger, allowing non-administrative users to read shared objects but not to modify shared objects they did not create.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Session Manager\ + +Value Name: ProtectionMode + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + ProtectionMode + Dword + + + <VulnDiscussion>Attachments from outside sources may contain malicious code. Preserving zone of origin (Internet, intranet, local, restricted) information on file attachments allows Windows to determine risk.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments + False + + The default behavior is for Windows to mark file attachments with their zone information. + +If the registry Value Name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0x00000002 (2) (or if the Value Name does not exist)", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_CURRENT_USER +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\ + +Value Name: SaveZoneInformation + +Value Type: REG_DWORD +Value: 0x00000002 (2) (or if the Value Name does not exist) + 2 + SaveZoneInformation + Dword + + + <VulnDiscussion>Allowing AutoPlay to execute may introduce malicious code to a system. AutoPlay begins reading from a drive as soon as media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. This setting will disable AutoPlay for non-volume devices, such as Media Transfer Protocol (MTP) devices.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ + +Value Name: NoAutoplayfornonVolume + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + NoAutoplayfornonVolume + Dword + + + <VulnDiscussion>Allowing AutoRun commands to execute may introduce malicious code to a system. Configuring this setting prevents AutoRun commands from executing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ + +Value Name: NoAutorun + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + NoAutorun + Dword + + + <VulnDiscussion>Allowing AutoPlay to execute may introduce malicious code to a system. AutoPlay begins reading from a drive as soon media is inserted into the drive. As a result, the setup file of programs or music on audio media may start. By default, AutoPlay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive) and on network drives. Enabling this policy disables AutoPlay on all drives.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ + +Value Name: NoDriveTypeAutoRun + +Type: REG_DWORD +Value: 0x000000ff (255) + 255 + NoDriveTypeAutoRun + Dword + + + <VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters + False + + Different methods are available to disable SMBv1 on Windows Server 2019, if WN19-00-000380 is configured, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\ + +Value Name: SMB1 + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + SMB1 + Dword + + + <VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mrxsmb10 + False + + Different methods are available to disable SMBv1 on Windows Server 2019, if WN19-00-000380 is configured, this is NA. + +If the following registry value is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\ + +Value Name: Start + +Type: REG_DWORD +Value: 0x00000004 (4) + 4 + Start + Dword + + + <VulnDiscussion>Slide shows that are displayed on the lock screen could display sensitive information to unauthorized personnel. Turning off this feature will limit access to the information to a logged-on user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization + False + + Verify the registry value below. + +If it does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Personalization\ + +Value Name: NoLockScreenSlideshow + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + NoLockScreenSlideshow + Dword + + + <VulnDiscussion>When the WDigest Authentication protocol is enabled, plain-text passwords are stored in the Local Security Authority Subsystem Service (LSASS), exposing them to theft. WDigest is disabled by default in Windows Server 2019. This setting ensures this is enforced.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\SecurityProviders\Wdigest\ + +Value Name: UseLogonCredential + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + UseLogonCredential + Dword + + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and will prevent uncontrolled updates to the system. + +This setting prevents the computer from downloading print driver packages over HTTP.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\ + +Value Name: DisableWebPnPDownload + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DisableWebPnPDownload + Dword + + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and will prevent uncontrolled updates to the system. + +This setting prevents the client computer from printing over HTTP, which allows the computer to print to printers on the intranet as well as the Internet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Printers\ + +Value Name: DisableHTTPPrinting + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DisableHTTPPrinting + Dword + + + <VulnDiscussion>Enabling interaction with the network selection UI allows users to change connections to available networks without signing in to Windows.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + False + + Verify the registry value below. If it does not exist or is not configured as specified, this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ + +Value Name: DontDisplayNetworkSelectionUI + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DontDisplayNetworkSelectionUI + Dword + + + <VulnDiscussion>Some features may communicate with the vendor, sending system information or downloading data or components for the feature. Turning off this capability will prevent potentially sensitive information from being sent outside the enterprise and will prevent uncontrolled updates to the system. + +This setting will prevent the Program Inventory from collecting data about a system and sending the information to Microsoft.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\AppCompat\ + +Value Name: DisableInventory + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DisableInventory + Dword + + + <VulnDiscussion>Windows Defender SmartScreen helps protect systems from programs downloaded from the internet that may be malicious. Enabling SmartScreen can block potentially malicious programs or warn users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + False + + This is applicable to unclassified systems; for other systems, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ + +Value Name: EnableSmartScreen + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + EnableSmartScreen + Dword + + + <VulnDiscussion>Basic authentication uses plain-text passwords that could be used to compromise a system. Disabling Basic authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds + False + + The default behavior is for the Windows RSS platform to not use Basic authentication over HTTP connections. + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0x00000000 (0) (or if the Value Name does not exist)", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds\ + +Value Name: AllowBasicAuthInClear + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist) + 0 + AllowBasicAuthInClear + Dword + + + <VulnDiscussion>Indexing of encrypted files may expose sensitive data. This setting prevents encrypted files from being indexed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Search + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Windows Search\ + +Value Name: AllowIndexingEncryptedStoresOrItems + +Value Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AllowIndexingEncryptedStoresOrItems + Dword + + + <VulnDiscussion>The username is one part of logon credentials that could be used to gain access to a system. Preventing the enumeration of users limits this information to authorized personnel.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System + False + + This applies to member servers. For domain controllers and standalone systems, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\System\ + +Value Name: EnumerateLocalUsers + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + EnumerateLocalUsers + Dword + + + <VulnDiscussion>Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system. The system must be configured to prevent users from saving passwords in the Remote Desktop Client. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: DisablePasswordSaving + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DisablePasswordSaving + Dword + + + <VulnDiscussion>This setting controls the ability of users to supply passwords automatically as part of their remote desktop connection. Disabling this setting would allow anyone to use the stored credentials in a connection item to connect to the terminal server. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fPromptForPassword + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + fPromptForPassword + Dword + + + <VulnDiscussion>Storage of administrative credentials could allow unauthorized access. Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ + +Value Name: DisableRunAs + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + DisableRunAs + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the built-in Administrator account so that it runs in Admin Approval Mode. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: FilterAdministratorToken + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + FilterAdministratorToken + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting controls the behavior of elevation when requested by a standard user account. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: ConsentPromptBehaviorUser + +Value Type: REG_DWORD +Value: 0x00000000 (0) + 0 + ConsentPromptBehaviorUser + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting enables UAC. + +Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableLUA + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + EnableLUA + Dword + + + <VulnDiscussion>Unauthenticated RPC clients may allow anonymous access to sensitive information. Configuring RPC to restrict unauthenticated RPC clients from connecting to the RPC server will prevent anonymous connections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Rpc + False + + This applies to member servers and standalone systems, it is NA for domain controllers. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Rpc\ + +Value Name: RestrictRemoteClients + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + RestrictRemoteClients + Dword + + + <VulnDiscussion>Computer account passwords are changed automatically on a regular basis. Disabling automatic password changes can make the system more vulnerable to malicious access. Frequent password changes can be a significant safeguard for the system. A new password for the computer account will be generated every 30 days.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: DisablePasswordChange + +Value Type: REG_DWORD +Value: 0x00000000 (0) + 0 + DisablePasswordChange + Dword + + + <VulnDiscussion>The LAN Manager hash uses a weak encryption algorithm and there are several tools available that use this hash to retrieve account passwords. This setting controls whether a LAN Manager hash of the password is stored in the SAM the next time the password is changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: NoLMHash + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + NoLMHash + Dword + + + <VulnDiscussion>Some non-Microsoft SMB servers only support unencrypted (plain-text) password authentication. Sending plain-text passwords across the network when authenticating to an SMB server reduces the overall security of the environment. Check with the vendor of the SMB server to determine if there is a way to support encrypted password authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ + +Value Name: EnablePlainTextPassword + +Value Type: REG_DWORD +Value: 0x00000000 (0) + 0 + EnablePlainTextPassword + Dword + + + <VulnDiscussion>If the private key is discovered, an attacker can use the key to authenticate as an authorized user and gain access to the network infrastructure. + +The cornerstone of the PKI is the private key used to encrypt or digitally sign information. + +If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user. + +Both the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Cryptography\ + +Value Name: ForceKeyProtection + +Type: REG_DWORD +Value: 0x00000002 (2) + 2 + ForceKeyProtection + Dword + + + <VulnDiscussion>Certain encryption types are no longer considered secure. The DES and RC4 encryption suites must not be used for Kerberos encryption. + +Note: Organizations with domain controllers running earlier versions of Windows where RC4 encryption is enabled, selecting "The other domain supports Kerberos AES Encryption" on domain trusts, may be required to allow client communication across the trust relationship.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\ + +Value Name: SupportedEncryptionTypes + +Value Type: REG_DWORD +Value: 0x7ffffff8 (2147483640) + 2147483640 + SupportedEncryptionTypes + Dword + + + <VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this. + +Satisfies: SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ + +Value Name: AllowUnencryptedTraffic + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AllowUnencryptedTraffic + Dword + + + <VulnDiscussion>Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this. + +Satisfies: SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ + +Value Name: AllowUnencryptedTraffic + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AllowUnencryptedTraffic + Dword + + + <VulnDiscussion>Basic authentication uses plain-text passwords that could be used to compromise a system. Disabling Basic authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ + +Value Name: AllowBasic + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AllowBasic + Dword + + + <VulnDiscussion>Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks. Disallowing Digest authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Client + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ + +Value Name: AllowDigest + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AllowDigest + Dword + + + <VulnDiscussion>Basic authentication uses plain-text passwords that could be used to compromise a system. Disabling Basic authentication will reduce this potential.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ + +Value Name: AllowBasic + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + AllowBasic + Dword + + + <VulnDiscussion>This setting ensures the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing. FIPS-compliant algorithms meet specific standards established by the U.S. Government and must be the algorithms used for all OS encryption functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy\ + +Value Name: Enabled + +Value Type: REG_DWORD +Value: 0x00000001 (1) + +Clients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms. Both the browser and web server must be configured to use TLS; otherwise. the browser will not be able to connect to a secure site. + 1 + Enabled + Dword + + + <VulnDiscussion>Enumeration of administrator accounts when elevating can provide part of the logon information to an unauthorized user. This setting configures the system to always require users to type in a username and password to elevate a running application.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\ + +Value Name: EnumerateAdministrators + +Type: REG_DWORD +Value: 0x00000000 (0) + 0 + EnumerateAdministrators + Dword + + + <VulnDiscussion>A compromised local administrator account can provide means for an attacker to move laterally between domain systems. + +With User Account Control enabled, filtering the privileged token for local administrator accounts will prevent the elevated privileges of these accounts from being used over the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + This applies to member servers. For domain controllers and standalone systems, this is NA. + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + +Value Name: LocalAccountTokenFilterPolicy + +Type: REG_DWORD +Value: 0x00000000 (0) + +This setting may cause issues with some network scanning tools if local administrative accounts are used remotely. Scans should use domain accounts where possible. If a local administrative account must be used, temporarily enabling the privileged token by configuring the registry value to "1" may be required. + 0 + LocalAccountTokenFilterPolicy + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting prevents User Interface Accessibility programs from disabling the secure desktop for elevation prompts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableUIADesktopToggle + +Value Type: REG_DWORD +Value: 0x00000000 (0) + 0 + EnableUIADesktopToggle + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures the elevation requirements for logged-on administrators to complete a task that requires raised privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + True + '{0}' -match '1|2' + UAC requirements are NA for Server Core installations (this is default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: ConsentPromptBehaviorAdmin + +Value Type: REG_DWORD +Value: 0x00000002 (2) (Prompt for consent on the secure desktop) +0x00000001 (1) (Prompt for credentials on the secure desktop) + + ConsentPromptBehaviorAdmin + Dword + + + <VulnDiscussion>User Account Control (UAC) is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting requires Windows to respond to application installation requests by prompting for credentials.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableInstallerDetection + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + EnableInstallerDetection + Dword + + + <VulnDiscussion>UAC is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures Windows to only allow applications installed in a secure location on the file system, such as the Program Files or the Windows\System32 folders, to run with elevated privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableSecureUIAPaths + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + EnableSecureUIAPaths + Dword + + + <VulnDiscussion>UAC is a security mechanism for limiting the elevation of privileges, including administrative accounts, unless authorized. This setting configures non-UAC-compliant applications to run in virtualized file and registry entries in per-user locations, allowing them to run.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System + False + + UAC requirements are NA for Server Core installations (this is the default installation option for Windows Server 2019 versus Server with Desktop Experience). + +If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ + +Value Name: EnableVirtualization + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + EnableVirtualization + Dword + + + <VulnDiscussion>Preventing users from sharing the local drives on their client computers with Remote Session Hosts that they access helps reduce possible exposure of sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\ + +Value Name: fDisableCdm + +Type: REG_DWORD +Value: 0x00000001 (1) + 1 + fDisableCdm + Dword + + + <VulnDiscussion>Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Control\Lsa\ + +Value Name: RestrictAnonymous + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + RestrictAnonymous + Dword + + + <VulnDiscussion>Allowing anonymous access to named pipes or shares provides the potential for unauthorized system access. This setting restricts access to those defined in "Network access: Named Pipes that can be accessed anonymously" and "Network access: Shares that can be accessed anonymously", both of which must be blank under other requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: RestrictNullSessAccess + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + RestrictNullSessAccess + Dword + + + <VulnDiscussion>Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the server's WINS resolution capability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netbt\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netbt\Parameters\ + +Value Name: NoNameReleaseOnDemand + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + NoNameReleaseOnDemand + Dword + + + <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted and signed. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: RequireSignOrSeal + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + RequireSignOrSeal + Dword + + + <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: SealSecureChannel + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + SealSecureChannel + Dword + + + <VulnDiscussion>Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked. If this policy is enabled, outgoing secure channel traffic will be signed. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: SignSecureChannel + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + SignSecureChannel + Dword + + + <VulnDiscussion>A computer connecting to a domain controller will establish a secure channel. The secure channel connection may be subject to compromise, such as hijacking or eavesdropping, if strong session keys are not used to establish the connection. Requiring strong session keys enforces 128-bit encryption between systems. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\ + +Value Name: RequireStrongKey + +Value Type: REG_DWORD +Value: 0x00000001 (1) + +This setting may prevent a system from being joined to a domain if not configured consistently between systems. + 1 + RequireStrongKey + Dword + + + <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ + +Value Name: RequireSecuritySignature + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + RequireSecuritySignature + Dword + + + <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. If this policy is enabled, the SMB client will request packet signing when communicating with an SMB server that is enabled or required to perform SMB packet signing. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\ + +Value Name: EnableSecuritySignature + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + EnableSecuritySignature + Dword + + + <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: RequireSecuritySignature + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + RequireSecuritySignature + Dword + + + <VulnDiscussion>The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will negotiate SMB packet signing as requested by the client. + +Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters + False + + If the following registry value does not exist or is not configured as specified, this is a finding: + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\ + +Value Name: EnableSecuritySignature + +Value Type: REG_DWORD +Value: 0x00000001 (1) + 1 + EnableSecuritySignature + Dword + + + <VulnDiscussion>Data Execution Prevention provides additional protection by performing checks on memory to help prevent malicious code from running. This setting will prevent Data Execution Prevention from being turned off for File Explorer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer + False + + The default behavior is for Data Execution Prevention to be turned on for File Explorer. + +If the registry value name below does not exist, this is not a finding. + +If it exists and is configured with a value of "0x00000000 (0) (or if the Value Name does not exist)", this is not a finding. + +If it exists and is configured with a value of "1", this is a finding. + +Registry Hive: HKEY_LOCAL_MACHINE +Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Explorer\ + +Value Name: NoDataExecutionPrevention + +Value Type: REG_DWORD +Value: 0x00000000 (0) (or if the Value Name does not exist) + 0 + NoDataExecutionPrevention + Dword + + + + + <VulnDiscussion>Allowing anonymous SID/Name translation can provide sensitive information for accessing a system. Only authorized users must be able to perform such translations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + Network access: Allow anonymous SID/Name translation + Disabled + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. + +If the value for "Network access: Allow anonymous SID/Name translation" is not set to "Disabled", this is a finding. + + + <VulnDiscussion>The built-in administrator account is a well-known account subject to attack. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + Accounts: Rename administrator account + + True + '{0}' -ne 'Administrator' + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. + +If the value for "Accounts: Rename administrator account" is not set to a value other than "Administrator", this is a finding. + + + + + <VulnDiscussion>The built-in guest account is a well-known user account on all Windows systems and, as initially installed, does not require a password. This can allow access to system resources by unauthorized users. Renaming this account to an unidentified name improves the protection of this account and the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + Accounts: Rename guest account + + True + '{0}' -ne 'Guest' + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. + +If the value for "Accounts: Rename guest account" is not set to a value other than "Guest", this is a finding. + + + + + <VulnDiscussion>A system faces an increased vulnerability threat if the built-in guest account is not disabled. This is a known account that exists on all Windows systems and cannot be deleted. This account is initialized during the installation of the operating system with no password assigned.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + Accounts: Guest account status + Disabled + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options. + +If the value for "Accounts: Guest account status" is not set to "Disabled", this is a finding. + + + + + + + <VulnDiscussion>Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operating system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + True + ServiceName/StartupType is populated with correct AntiVirus service information + Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution. + +If there is no anti-virus solution installed on the system, this is a finding. + + + Running + + + + + <VulnDiscussion>A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Present + False + True + ServiceName/StartupType is populated with correct Firewall service information + Determine if a host-based firewall is installed and enabled on the system. + +If a host-based firewall is not installed and enabled on the system, this is a finding. + +The configuration requirements will be determined by the applicable firewall STIG. + + + Running + + + + + + + SeDenyRemoteInteractiveLogonRight + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on through Remote Desktop Services" user right defines the accounts that are prevented from logging on using Remote Desktop Services. + +In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. + +Local accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Deny log on through Remote Desktop Services + + False + Enterprise Admins,Domain Admins,Local account,Guests + False + False + + This applies to member servers and standalone systems. A separate version applies to domain controllers. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on through Remote Desktop Services" user right, this is a finding: + +Domain Systems Only: +- Enterprise Admins group +- Domain Admins group +- Local account (see Note below) + +All Systems: +- Guests group + + + + + SeNetworkLogonRight + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Access this computer from the network" user right may access resources on the system, and this right must be limited to those requiring it.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Access this computer from the network + + True + Administrators,Authenticated Users + False + False + + This applies to member servers and standalone systems. A separate version applies to domain controllers. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Access this computer from the network" user right, this is a finding: + +- Administrators +- Authenticated Users + + + + + SeDenyNetworkLogonRight + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny access to this computer from the network" user right defines the accounts that are prevented from logging on from the network. + +In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. + +Local accounts on domain-joined systems must also be assigned this right to decrease the risk of lateral movement resulting from credential theft attacks. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Deny access to this computer from the network + + False + + False + True + '{0}' -match 'Enterprise Admins,Domain Admins,(Local account and member of Administrators group|Local account),Guests' + This applies to member servers and standalone systems. A separate version applies to domain controllers. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny access to this computer from the network" user right, this is a finding: + +Domain Systems Only: +- Enterprise Admins group +- Domain Admins group +- "Local account and member of Administrators group" or "Local account" (see Note below) + +All Systems: +- Guests group + + + + + SeDenyBatchLogonRight + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on as a batch job" user right defines accounts that are prevented from logging on to the system as a batch job, such as Task Scheduler. + +In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. + +The Guests group must be assigned to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Deny log on as a batch job + + False + Enterprise Admins,Domain Admins,Guests + False + False + + This applies to member servers and standalone systems. A separate version applies to domain controllers. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on as a batch job" user right, this is a finding: + +Domain Systems Only: +- Enterprise Admins Group +- Domain Admins Group + +All Systems: +- Guests Group + + + + + SeDenyServiceLogonRight + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on as a service" user right defines accounts that are denied logon as a service. + +In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. + +Incorrect configurations could prevent services from starting and result in a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Deny log on as a service + + True + Enterprise Admins,Domain Admins + False + False + + This applies to member servers and standalone systems. A separate version applies to domain controllers. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on as a service" user right on domain-joined systems, this is a finding: + +- Enterprise Admins Group +- Domain Admins Group + +If any accounts or groups are defined for the "Deny log on as a service" user right on non-domain-joined systems, this is a finding. + + + + + SeDenyInteractiveLogonRight + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Deny log on locally" user right defines accounts that are prevented from logging on interactively. + +In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain. + +The Guests group must be assigned this right to prevent unauthenticated access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Deny log on locally + + False + Enterprise Admins,Domain Admins,Guests + False + False + + This applies to member servers and standalone systems. A separate version applies to domain controllers. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If the following accounts or groups are not defined for the "Deny log on locally" user right, this is a finding: + +Domain Systems Only: +- Enterprise Admins Group +- Domain Admins Group + +All Systems: +- Guests Group + + + + + SeInteractiveLogonRight + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Allow log on locally" user right can log on interactively to a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Allow log on locally + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Allow log on locally" user right, this is a finding: + +- Administrators + + + + + SeEnableDelegationPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Enable computer and user accounts to be trusted for delegation" user right allows the "Trusted for Delegation" setting to be changed. This could allow unauthorized users to impersonate other users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Enable computer and user accounts to be trusted for delegation + + True + NULL + False + False + + This applies to member servers and standalone systems. A separate version applies to domain controllers. + +Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Enable computer and user accounts to be trusted for delegation" user right, this is a finding. + + + + + SeTrustedCredManAccessPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Access Credential Manager as a trusted caller" user right may be able to retrieve the credentials of other accounts from Credential Manager.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Access Credential Manager as a trusted caller + + True + NULL + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Access Credential Manager as a trusted caller" user right, this is a finding. + + + + + SeTcbPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Act as part of the operating system" user right can assume the identity of any user and gain access to resources that the user is authorized to access. Any accounts with this right can take complete control of a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Act as part of the operating system + + True + NULL + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups (to include administrators), are granted the "Act as part of the operating system" user right, this is a finding. + + + + + SeBackupPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Back up files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Back up files and directories + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Back up files and directories" user right, this is a finding: + +- Administrators + + + + + SeCreatePagefilePrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create a pagefile" user right can change the size of a pagefile, which could affect system performance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Create a pagefile + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Create a pagefile" user right, this is a finding: + +- Administrators + + + + + SeCreateTokenPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Create a token object" user right allows a process to create an access token. This could be used to provide elevated rights and compromise a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Create a token object + + True + NULL + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Create a token object" user right, this is a finding. + + + + + SeCreateGlobalPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create global objects" user right can create objects that are available to all sessions, which could affect processes in other users' sessions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Create global objects + + True + Administrators,Service,Local Service,Network Service + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Create global objects" user right, this is a finding: + +- Administrators +- Service +- Local Service +- Network Service + + + + + SeCreatePermanentPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create permanent shared objects" user right could expose sensitive data by creating shared objects.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Create permanent shared objects + + True + NULL + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Create permanent shared objects" user right, this is a finding. + + + + + SeCreateSymbolicLinkPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Create symbolic links" user right can create pointers to other objects, which could expose the system to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Create symbolic links + + True + + False + True + '{0}' -match '^(Administrators,NT Virtual Machine\\Virtual Machines|Administrators)$' + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Create symbolic links" user right, this is a finding: + +- Administrators + + + + + SeDebugPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Debug programs" user right can attach a debugger to any process or to the kernel, providing complete access to sensitive and critical operating system components. This right is given to Administrators in the default configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Debug programs + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Debug programs" user right, this is a finding: + +- Administrators + + + + + SeRemoteShutdownPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Force shutdown from a remote system" user right can remotely shut down a system, which could result in a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Force shutdown from a remote system + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Force shutdown from a remote system" user right, this is a finding: + +- Administrators + + + + + SeAuditPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Generate security audits" user right specifies users and processes that can generate Security Log audit records, which must only be the system service accounts defined.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Generate security audits + + True + Local Service,Network Service + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Generate security audits" user right, this is a finding: + +- Local Service +- Network Service + + + + + SeImpersonatePrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Impersonate a client after authentication" user right allows a program to impersonate another user or account to run on their behalf. An attacker could use this to elevate privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Impersonate a client after authentication + + True + Administrators,Service,Local Service,Network Service + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Impersonate a client after authentication" user right, this is a finding: + +- Administrators +- Service +- Local Service +- Network Service + + + + + SeIncreaseBasePriorityPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Increase scheduling priority" user right can change a scheduling priority, causing performance issues or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Increase scheduling priority + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Increase scheduling priority" user right, this is a finding: + +- Administrators + + + + + SeLoadDriverPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Load and unload device drivers" user right allows a user to load device drivers dynamically on a system. This could be used by an attacker to install malicious code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Load and unload device drivers + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Load and unload device drivers" user right, this is a finding: + +- Administrators + + + + + SeLockMemoryPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +The "Lock pages in memory" user right allows physical memory to be assigned to processes, which could cause performance issues or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Lock pages in memory + + True + NULL + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups are granted the "Lock pages in memory" user right, this is a finding. + + + + + SeSystemEnvironmentPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Modify firmware environment values" user right can change hardware configuration environment variables. This could result in hardware failures or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Modify firmware environment values + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Modify firmware environment values" user right, this is a finding: + +- Administrators + + + + + SeManageVolumePrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Perform volume maintenance tasks" user right can manage volume and disk configurations. This could be used to delete volumes, resulting in data loss or a denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Perform volume maintenance tasks + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Perform volume maintenance tasks" user right, this is a finding: + +- Administrators + + + + + SeProfileSingleProcessPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Profile single process" user right can monitor non-system processes performance. An attacker could use this to identify processes to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Profile single process + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Profile single process" user right, this is a finding: + +- Administrators + + + + + SeRestorePrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Restore files and directories" user right can circumvent file and directory permissions and could allow access to sensitive data. It could also be used to overwrite more current data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Restore files and directories + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Restore files and directories" user right, this is a finding: + +- Administrators + + + + + SeTakeOwnershipPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Take ownership of files or other objects" user right can take ownership of objects and make changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Take ownership of files or other objects + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Take ownership of files or other objects" user right, this is a finding: + +- Administrators + + + + + SeSecurityPrivilege + <VulnDiscussion>Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. + +Accounts with the "Manage auditing and security log" user right can manage the security log and change auditing configurations. This could be used to clear evidence of tampering. + +Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000063-GPOS-00032, SRG-OS-000337-GPOS-00129</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + Manage auditing and security log + + True + Administrators + False + False + + Verify the effective setting in Local Group Policy Editor. + +Run "gpedit.msc". + +Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. + +If any accounts or groups other than the following are granted the "Manage auditing and security log" user right, this is a finding. + +- Administrators + + + + + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + Fax + False + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq Fax". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + PNRP + False + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq PNRP". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + Simple-TCPIP + False + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq Simple-TCPIP". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + TFTP-Client + False + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq TFTP-Client". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + <VulnDiscussion>SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks and is not FIPS compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + FS-SMB1 + False + + Different methods are available to disable SMBv1 on Windows Server 2019. This is the preferred method, however if WN19-00-000390 and WN19-00-000400 are configured, this is NA. + +Open "Windows PowerShell" with elevated privileges (run as administrator). + +Enter "Get-WindowsFeature -Name FS-SMB1". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + <VulnDiscussion>Windows PowerShell 5.x added advanced logging features that can provide additional detail when malware has been run on a system. Disabling the Windows PowerShell 2.0 mitigates against a downgrade attack that evades the Windows PowerShell 5.x script block logging feature.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + PowerShell-v2 + False + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq PowerShell-v2". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + Web-Ftp-Service + False + + If the server has the role of an FTP server, this is NA. + +Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq Web-Ftp-Service". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + +If the system has the role of an FTP server, this must be documented with the ISSO. + + + <VulnDiscussion>Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption or may provide unauthorized access to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + Absent + False + Telnet-Client + False + + Open "PowerShell". + +Enter "Get-WindowsFeature | Where Name -eq Telnet-Client". + +If "Installed State" is "Installed", this is a finding. + +An Installed State of "Available" or "Removed" is not a finding. + + + From dd1718f319845c0d298fb0687c99064b0903da11 Mon Sep 17 00:00:00 2001 From: Steve Hose <33662177+stevehose@users.noreply.github.com> Date: Thu, 19 Dec 2019 23:18:52 -0500 Subject: [PATCH 27/42] Updates to fix build bugs --- Tests/Integration/PowerStig.Integration.tests.ps1 | 2 +- Tests/Unit/Module/STIG.tests.ps1 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Tests/Integration/PowerStig.Integration.tests.ps1 b/Tests/Integration/PowerStig.Integration.tests.ps1 index 28eed4f86..801f6ece6 100644 --- a/Tests/Integration/PowerStig.Integration.tests.ps1 +++ b/Tests/Integration/PowerStig.Integration.tests.ps1 @@ -17,7 +17,7 @@ Describe "$moduleName module" { Context 'Exported Commands' { $commands = (Get-Command -Module $moduleName).Name - $exportedCommands = @('Get-DomainName', 'Get-Stig', 'New-StigCheckList') + $exportedCommands = @('Get-DomainName', 'Get-Stig', 'New-StigCheckList', 'Get-StigRuleList', 'Get-StigVersionNumber', 'Get-PowerStigFileList', 'Split-BenchmarkId') foreach ($export in $exportedCommands) { diff --git a/Tests/Unit/Module/STIG.tests.ps1 b/Tests/Unit/Module/STIG.tests.ps1 index 5ddb5c2db..b9fe72eb6 100644 --- a/Tests/Unit/Module/STIG.tests.ps1 +++ b/Tests/Unit/Module/STIG.tests.ps1 @@ -1,5 +1,6 @@ #region Header using module .\..\..\..\Module\STIG\Convert\Convert.Main.psm1 +. $PSScriptRoot\..\..\..\Module\STIG\Functions.XccdfXml.ps1 . $PSScriptRoot\.tests.header.ps1 #endregion try @@ -82,7 +83,6 @@ try #> } Describe 'Split-BenchmarkId' { - $sampleStrings = [ordered]@{ 'SQLServer' = @( @{ From 8c616c31ec844283a1b745386753109c8431c9a0 Mon Sep 17 00:00:00 2001 From: Steve Hose <33662177+stevehose@users.noreply.github.com> Date: Thu, 19 Dec 2019 23:52:33 -0500 Subject: [PATCH 28/42] Updated to fix bugs in build --- ...qlServer-2016-Instance-1.3.org.default.xml | 13 +- .../Processed/SqlServer-2016-Instance-1.3.xml | 497 ++++++------------ 2 files changed, 161 insertions(+), 349 deletions(-) diff --git a/StigData/Processed/SqlServer-2016-Instance-1.3.org.default.xml b/StigData/Processed/SqlServer-2016-Instance-1.3.org.default.xml index 228a174df..fb45b2556 100644 --- a/StigData/Processed/SqlServer-2016-Instance-1.3.org.default.xml +++ b/StigData/Processed/SqlServer-2016-Instance-1.3.org.default.xml @@ -5,4 +5,15 @@ Each setting in this file is linked by STIG ID and the valid range is in an associated comment. --> - + + + + + + + + + + + + diff --git a/StigData/Processed/SqlServer-2016-Instance-1.3.xml b/StigData/Processed/SqlServer-2016-Instance-1.3.xml index e644214ff..512349093 100644 --- a/StigData/Processed/SqlServer-2016-Instance-1.3.xml +++ b/StigData/Processed/SqlServer-2016-Instance-1.3.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>Database management includes the ability to control the number of users and user sessions utilizing SQL Server. Unlimited concurrent connections to SQL Server could allow a successful Denial of Service (DoS) attack by exhausting connection resources; and a system can also fail or be degraded by an overload of legitimate users. Limiting the number of concurrent sessions per user is helpful in reducing these risks. @@ -674,6 +674,32 @@ Launch SQL Server Configuration Manager. If any components that are installed but are not required are not disabled, this is a finding. If any required components are not installed, this is a finding. + + + <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). + +It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. + +Applications must adhere to the principles of least functionality by providing only essential capabilities. + +SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. + +The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity. + +To determine if xp_cmdshell is enabled, execute the following commands: + +EXEC SP_CONFIGURE 'show advanced options', '1'; +RECONFIGURE WITH OVERRIDE; +EXEC SP_CONFIGURE 'xp_cmdshell'; + +If the value of "config_value" is "0", this is not a finding. + +Review the system documentation to determine whether the use of "xp_cmdshell" is required and approved. If it is not approved, this is a finding. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). @@ -905,6 +931,40 @@ Review system configuration to determine whether Instant File Initialization sup Start >> Control Panel >> Administrative Tools >> Local Security Policy >> Local Policies >> Security Options If the SQL Service SID (Default instance: NT SERVICE\MSSQLSERVER. Named instance: NT SERVICE\MSSQL$InstanceName) has been granted "Perform volume maintenance tasks" Local Rights Assignment and it is not documented in the system documentation, this is a finding. + + + <VulnDiscussion>SQL Server must prevent unauthorized and unintended information transfer via shared system resources. Permitting only SQL Server processes and authorized, administrative users to have access to the files where the database resides helps ensure that those files are not shared inappropriately and are not open to backdoor access and manipulation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + Review the permissions granted to users by the operating system/file system on the database files, database log files, and database backup files. + +To obtain the location of SQL Server data, transaction log, and backup files, open and execute the supplemental file "Get SQL Data and Backup Directories.sql". + +For each of the directories returned by the above script, verify whether the correct permissions have been applied. + +1) Launch Windows Explorer. +2) Navigate to the folder. +3) Right-click the folder and click "Properties". +4) Navigate to the "Security" tab. +5) Review the listing of principals and permissions. + +Account Type Directory Type Permission +----------------------------------------------------------------------------------------------- +Database Administrators ALL Full Control +SQL Server Service SID Data; Log; Backup; Full Control +SQL Server Agent Service SID Backup Full Control +SYSTEM ALL Full Control +CREATOR OWNER ALL Full Control + +For information on how to determine a "Service SID", go to: +https://aka.ms/sql-service-sids + +Additional permission requirements, including full directory permissions and operating system rights for SQL Server, are documented at: +https://aka.ms/sqlservicepermissions + +If any additional permissions are granted but not documented as authorized, this is a finding. <VulnDiscussion>Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. @@ -2175,6 +2235,27 @@ Note: <name> represents the username portion of the login. For example, if If no account information is returned, this is not a finding. If account information is returned, this is a finding. + + + <VulnDiscussion>Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation for the whole time SQL Server is running.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> + + False + False + + When Audits are enabled, they start up when the instance starts. +https://msdn.microsoft.com/en-us/library/cc280386.aspx#Anchor_2 + +Check if an audit is configured and enabled. + +Execute the following query: + +SELECT name AS 'Audit Name', +status_desc AS 'Audit Status', +audit_file_path AS 'Current Audit File' +FROM sys.dm_server_audit_status +WHERE status_desc = 'STARTED' + +All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding. <VulnDiscussion>If audit data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to audit records provides information an attacker could potentially use to his or her advantage. @@ -2649,260 +2730,6 @@ Database applications may allow for entry of the account name and password as a If any do, determine whether these applications obfuscate authentication data; if they do not, this is a finding. - - - - <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). - -It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. - -Applications must adhere to the principles of least functionality by providing only essential capabilities. - -SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. - -The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - True - False - False - - - The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity. - -To determine if xp_cmdshell is enabled, execute the following commands: - -EXEC SP_CONFIGURE 'show advanced options', '1'; -RECONFIGURE WITH OVERRIDE; -EXEC SP_CONFIGURE 'xp_cmdshell'; - -If the value of "config_value" is "0", this is not a finding. - -Review the system documentation to determine whether the use of "xp_cmdshell" is required and approved. If it is not approved, this is a finding. - - - - <VulnDiscussion>SQL Server must prevent unauthorized and unintended information transfer via shared system resources. Permitting only SQL Server processes and authorized, administrative users to have access to the files where the database resides helps ensure that those files are not shared inappropriately and are not open to backdoor access and manipulation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79177 - True - False - False - - - Review the permissions granted to users by the operating system/file system on the database files, database log files, and database backup files. - -To obtain the location of SQL Server data, transaction log, and backup files, open and execute the supplemental file "Get SQL Data and Backup Directories.sql". - -For each of the directories returned by the above script, verify whether the correct permissions have been applied. - -1) Launch Windows Explorer. -2) Navigate to the folder. -3) Right-click the folder and click "Properties". -4) Navigate to the "Security" tab. -5) Review the listing of principals and permissions. - -Account Type Directory Type Permission ------------------------------------------------------------------------------------------------ -Database Administrators ALL Full Control -SQL Server Service SID Data; Log; Backup; Full Control -SQL Server Agent Service SID Backup Full Control -SYSTEM ALL Full Control -CREATOR OWNER ALL Full Control - -For information on how to determine a "Service SID", go to: -https://aka.ms/sql-service-sids - -Additional permission requirements, including full directory permissions and operating system rights for SQL Server, are documented at: -https://aka.ms/sqlservicepermissions - -If any additional permissions are granted but not documented as authorized, this is a finding. - - - - <VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. - -In an SQL environment, adding permissions is typically done via the GRANT command, or, in the negative, the DENY command.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79177 - True - False - False - - - Check the SQL Server Audit being used for the STIG compliant audit. - -If the following events are not included, this is a finding. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspx - - - - <VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. - -In an SQL environment, adding permissions is typically done via the GRANT command, or, in the negative, the DENY command. - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79177 - True - False - False - - - Check the SQL Server Audit being used for the STIG compliant audit. - -If the following events are not included, this is a finding. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspx - - - - <VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. - -In an SQL environment, modifying permissions is typically done via the GRANT, REVOKE, and DENY commands.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79177 - True - False - False - - - Check the SQL Server Audit being used for the STIG compliant audit. - -If the following events are not included, this is a finding. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspx - - - - <VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. - -In an SQL environment, modifying permissions is typically done via the GRANT, REVOKE, and DENY commands. - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79177 - True - False - False - - - Check the SQL Server Audit being used for the STIG compliant audit. - -If the following events are not included, this is a finding. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspx - - - - <VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. - -In an SQL environment, deleting permissions is typically done via the REVOKE or DENY command.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79177 - True - False - False - - - Check the SQL Server Audit being used for the STIG compliant audit. - -If the following events are not included, this is a finding. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspx - - - - <VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. - -In an SQL environment, deleting permissions is typically done via the REVOKE or DENY command. - -To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79177 - True - False - False - - - Check the SQL Server Audit being used for the STIG compliant audit. - -If the following events are not included, this is a finding. - -DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP -DATABASE_OBJECT_PERMISSION_CHANGE_GROUP -DATABASE_OWNERSHIP_CHANGE_GROUP -DATABASE_PERMISSION_CHANGE_GROUP -DATABASE_ROLE_MEMBER_CHANGE_GROUP -SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP -SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP -SERVER_OBJECT_PERMISSION_CHANGE_GROUP -SERVER_PERMISSION_CHANGE_GROUP -SERVER_ROLE_MEMBER_CHANGE_GROUP - -Reference: -https://msdn.microsoft.com/en-us/library/cc280663.aspx - - <VulnDiscussion>The DoD standard for authentication is DoD-approved PKI certificates. PKI certificate-based authentication is performed by requiring the certificate holder to cryptographically prove possession of the corresponding private key. @@ -2930,40 +2757,14 @@ For more information, see https://support.microsoft.com/en-us/kb/3141890. - - <VulnDiscussion>Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation for the whole time SQL Server is running.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 - False - False - - When Audits are enabled, they start up when the instance starts. -https://msdn.microsoft.com/en-us/library/cc280386.aspx#Anchor_2 - -Check if an audit is configured and enabled. - -Execute the following query: - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status -WHERE status_desc = 'STARTED' - -All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 - - - <VulnDiscussion>Without auditing the enforcement of access restrictions against changes to configuration, it would be difficult to identify attempted attacks and an audit trail would not be available for forensic investigation for after-the-fact actions. Enforcement actions are the methods or mechanisms used to prevent unauthorized changes to configuration settings. Enforcement action methods may be as simple as denying access to a file based on the application of file permissions (access restriction). Audit items may consist of lists of actions blocked by access restrictions or changes identified after the fact.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_ACCESS_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_ACCESS_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False - False + True Determine if an audit is configured to capture denied actions and started by executing the following query: @@ -3046,17 +2847,17 @@ AND d.audit_action_name IN ( ) If the identified groups are not returned, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_ACCESS_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 - + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_ACCESS_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + auditPath={0} - + <VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. In an SQL environment, adding permissions is typically done via the GRANT command, or, in the negative, the DENY command.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3078,19 +2879,19 @@ SERVER_ROLE_MEMBER_CHANGE_GROUP Reference: https://msdn.microsoft.com/en-us/library/cc280663.aspx - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 - + <VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. In an SQL environment, adding permissions is typically done via the GRANT command, or, in the negative, the DENY command. To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79259.b - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + V-79259 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3112,17 +2913,17 @@ SERVER_ROLE_MEMBER_CHANGE_GROUP Reference: https://msdn.microsoft.com/en-us/library/cc280663.aspx - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 - + <VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. In an SQL environment, modifying permissions is typically done via the GRANT, REVOKE, and DENY commands.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79259.b - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + V-79259 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3144,19 +2945,19 @@ SERVER_ROLE_MEMBER_CHANGE_GROUP Reference: https://msdn.microsoft.com/en-us/library/cc280663.aspx - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 - + <VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. In an SQL environment, modifying permissions is typically done via the GRANT, REVOKE, and DENY commands. To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79259.b - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + V-79259 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3178,14 +2979,14 @@ SERVER_ROLE_MEMBER_CHANGE_GROUP Reference: https://msdn.microsoft.com/en-us/library/cc280663.aspx - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 - + <VulnDiscussion>Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79141 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3211,7 +3012,7 @@ JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.s WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 @@ -3220,7 +3021,7 @@ If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is <VulnDiscussion>Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative. To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79141 + V-79267 USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3246,17 +3047,17 @@ JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.s WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 - + <VulnDiscussion>Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users. In an SQL environment, deleting permissions is typically done via the REVOKE or DENY command.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79259.b - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + V-79259 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3278,19 +3079,19 @@ SERVER_ROLE_MEMBER_CHANGE_GROUP Reference: https://msdn.microsoft.com/en-us/library/cc280663.aspx - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 - + <VulnDiscussion>Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go undetected. In an SQL environment, deleting permissions is typically done via the REVOKE or DENY command. To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79259.b - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + V-79259 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3312,14 +3113,14 @@ SERVER_ROLE_MEMBER_CHANGE_GROUP Reference: https://msdn.microsoft.com/en-us/library/cc280663.aspx - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 <VulnDiscussion>The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an event occurs, it must be logged.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79141 + V-79267 USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3345,7 +3146,7 @@ JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.s WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 @@ -3354,7 +3155,7 @@ If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is <VulnDiscussion>The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an action is attempted, it must be logged. To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79141 + V-79267 USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3380,7 +3181,7 @@ JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.s WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 @@ -3388,9 +3189,9 @@ If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is <VulnDiscussion>For completeness of forensic analysis, it is necessary to track who/what (a user or other principal) logs on to SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (SUCCESSFUL_LOGIN_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('SUCCESSFUL_LOGIN_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False - False + True Determine if an audit is configured and started by executing the following query. @@ -3421,14 +3222,14 @@ Right-click on the instance >> Check the setting for "Login auditing" If "Both failed and successful logins" is not selected, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (SUCCESSFUL_LOGIN_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 - + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('SUCCESSFUL_LOGIN_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + auditPath={0} <VulnDiscussion>For completeness of forensic analysis, it is necessary to track failed attempts to log on to SQL Server. While positive identification may not be possible in a case of failed authentication, as much information as possible about the incident must be captured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79141 + V-79267 USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3454,7 +3255,7 @@ JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.s WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'FAILED_LOGIN_GROUP' If the "FAILED_LOGIN_GROUP" is not returned in an active audit, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 @@ -3489,9 +3290,9 @@ Depending on the capabilities of SQL Server and the design of the database and a Note that it is particularly important to audit, and tightly control, any action that weakens the implementation of this requirement itself, since the objective is to have a complete audit trail of all administrative activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False - False + True Determine if an audit is configured and started by executing the following query: @@ -3545,9 +3346,9 @@ WHERE a.is_state_enabled = 1 AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHANGE_GROUP','BACKUP_RESTORE_GROUP','DATABASE_CHANGE_GROUP','DATABASE_OBJECT_CHANGE_GROUP','DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP','DATABASE_OBJECT_PERMISSION_CHANGE_GROUP','DATABASE_OPERATION_GROUP','DATABASE_OWNERSHIP_CHANGE_GROUP','DATABASE_PERMISSION_CHANGE_GROUP','DATABASE_PRINCIPAL_CHANGE_GROUP','DATABASE_PRINCIPAL_IMPERSONATION_GROUP','DATABASE_ROLE_MEMBER_CHANGE_GROUP','DBCC_GROUP','LOGIN_CHANGE_PASSWORD_GROUP','SCHEMA_OBJECT_CHANGE_GROUP','SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP','SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OBJECT_CHANGE_GROUP','SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP','SERVER_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OPERATION_GROUP','SERVER_PERMISSION_CHANGE_GROUP','SERVER_PRINCIPAL_CHANGE_GROUP','SERVER_PRINCIPAL_IMPERSONATION_GROUP','SERVER_ROLE_MEMBER_CHANGE_GROUP','SERVER_STATE_CHANGE_GROUP','TRACE_CHANGE_GROUP','USER_CHANGE_PASSWORD_GROUP') If the identified groups are not returned, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 - + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + auditPath={0} @@ -3567,7 +3368,7 @@ Note that it is particularly important to audit, and tightly control, any action To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> V-79291 - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3623,8 +3424,8 @@ WHERE a.is_state_enabled = 1 AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHANGE_GROUP','BACKUP_RESTORE_GROUP','DATABASE_CHANGE_GROUP','DATABASE_OBJECT_CHANGE_GROUP','DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP','DATABASE_OBJECT_PERMISSION_CHANGE_GROUP','DATABASE_OPERATION_GROUP','DATABASE_OWNERSHIP_CHANGE_GROUP','DATABASE_PERMISSION_CHANGE_GROUP','DATABASE_PRINCIPAL_CHANGE_GROUP','DATABASE_PRINCIPAL_IMPERSONATION_GROUP','DATABASE_ROLE_MEMBER_CHANGE_GROUP','DBCC_GROUP','LOGIN_CHANGE_PASSWORD_GROUP','SCHEMA_OBJECT_CHANGE_GROUP','SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP','SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OBJECT_CHANGE_GROUP','SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP','SERVER_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OPERATION_GROUP','SERVER_PERMISSION_CHANGE_GROUP','SERVER_PRINCIPAL_CHANGE_GROUP','SERVER_PRINCIPAL_IMPERSONATION_GROUP','SERVER_ROLE_MEMBER_CHANGE_GROUP','SERVER_STATE_CHANGE_GROUP','TRACE_CHANGE_GROUP','USER_CHANGE_PASSWORD_GROUP') If the identified groups are not returned, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 @@ -3633,7 +3434,7 @@ If the identified groups are not returned, this is a finding. Disconnection may be initiated by the user or forced by the system (as in a timeout) or result from a system or network failure. To the greatest extent possible, all disconnections must be logged.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> V-79291 - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3689,8 +3490,8 @@ WHERE a.is_state_enabled = 1 AND d.audit_action_name IN ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP','AUDIT_CHANGE_GROUP','BACKUP_RESTORE_GROUP','DATABASE_CHANGE_GROUP','DATABASE_OBJECT_CHANGE_GROUP','DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP','DATABASE_OBJECT_PERMISSION_CHANGE_GROUP','DATABASE_OPERATION_GROUP','DATABASE_OWNERSHIP_CHANGE_GROUP','DATABASE_PERMISSION_CHANGE_GROUP','DATABASE_PRINCIPAL_CHANGE_GROUP','DATABASE_PRINCIPAL_IMPERSONATION_GROUP','DATABASE_ROLE_MEMBER_CHANGE_GROUP','DBCC_GROUP','LOGIN_CHANGE_PASSWORD_GROUP','SCHEMA_OBJECT_CHANGE_GROUP','SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP','SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OBJECT_CHANGE_GROUP','SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP','SERVER_OBJECT_PERMISSION_CHANGE_GROUP','SERVER_OPERATION_GROUP','SERVER_PERMISSION_CHANGE_GROUP','SERVER_PRINCIPAL_CHANGE_GROUP','SERVER_PRINCIPAL_IMPERSONATION_GROUP','SERVER_ROLE_MEMBER_CHANGE_GROUP','SERVER_STATE_CHANGE_GROUP','TRACE_CHANGE_GROUP','USER_CHANGE_PASSWORD_GROUP') If the identified groups are not returned, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 @@ -3700,7 +3501,7 @@ If the identified groups are not returned, this is a finding. Concurrent connections by the same user from multiple workstations may be valid use of the system; or such connections may be due to improper circumvention of the requirement to use the CAC for authentication; or they may indicate unauthorized account sharing; or they may be because an account has been compromised. (If the fact of multiple, concurrent logons by a given user can be reliably reconstructed from the log entries for other events (logons/connections; voluntary and involuntary disconnections), then it is not mandatory to create additional log entries specifically for this.)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - V-79141 + V-79267 USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3733,7 +3534,7 @@ In SQL Management Studio: Right-click on the instance >> Select "Properties" >> Select "Security" on the left hand side >> Check the setting for "Login auditing" If "Both failed and successful logins" is not selected, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 @@ -3747,7 +3548,7 @@ Some applications that run on SQL Server require the [sa] account to be enabled USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled <> 1; False - False + True Check SQL Server settings to determine if the [sa] (system administrator) account has been disabled by executing the following query: @@ -3763,7 +3564,7 @@ Verify that the "name" column contains the current name of the [sa] database ser If the "is_disabled" column is not set to 1, this is a finding. USE [master] DECLARE @SysAdminAccountName varchar(50), @cmd NVARCHAR(100), @saDisabled int SET @SysAdminAccountName = (SELECT name FROM sys.sql_logins WHERE principal_id = 1) SELECT @cmd = N'ALTER LOGIN ['+@SysAdminAccountName+'] DISABLE;' SET @saDisabled = (SELECT is_disabled FROM sys.sql_logins WHERE principal_id = 1) IF @saDisabled <> 1 exec sp_executeSQL @cmd; USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled <> 1; - + saAccountName={0} @@ -3773,7 +3574,7 @@ Since the SQL Server [sa] is administrative in nature, the compromise of a defau V-79317 USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled <> 1; False - False + True Verify the SQL Server default [sa] (system administrator) account name has been changed by executing the following query: @@ -3787,7 +3588,7 @@ GO If the login account name "SA" or "sa" appears in the query output, this is a finding. USE [master] DECLARE @SysAdminAccountName varchar(50), @cmd NVARCHAR(100), @saDisabled int SET @SysAdminAccountName = (SELECT name FROM sys.sql_logins WHERE principal_id = 1) SELECT @cmd = N'ALTER LOGIN ['+@SysAdminAccountName+'] DISABLE;' SET @saDisabled = (SELECT is_disabled FROM sys.sql_logins WHERE principal_id = 1) IF @saDisabled <> 1 exec sp_executeSQL @cmd; USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled <> 1; - + saAccountName={0} From d2e1c4a88c13ef125289e2e11c019bf0c45d5783 Mon Sep 17 00:00:00 2001 From: Steve Hose <33662177+stevehose@users.noreply.github.com> Date: Fri, 20 Dec 2019 01:05:14 -0500 Subject: [PATCH 29/42] Fix to missing reference --- Tests/Unit/Module/Common.tests.ps1 | 1 + 1 file changed, 1 insertion(+) diff --git a/Tests/Unit/Module/Common.tests.ps1 b/Tests/Unit/Module/Common.tests.ps1 index 0cb18da6d..78e0ec799 100644 --- a/Tests/Unit/Module/Common.tests.ps1 +++ b/Tests/Unit/Module/Common.tests.ps1 @@ -1,4 +1,5 @@ using module .\..\..\..\Module\Common\Common.psm1 +. $PSScriptRoot\..\..\..\Module\Stig\Functions.XccdfXml.ps1 . $PSScriptRoot\.tests.header.ps1 # Header #region Enum Tests From 3b98c572fdd5751ad373d4be33760a8c190086ec Mon Sep 17 00:00:00 2001 From: Steve Hose <33662177+stevehose@users.noreply.github.com> Date: Fri, 20 Dec 2019 01:09:35 -0500 Subject: [PATCH 30/42] Build error fix - missing newline --- Module/STIG/Functions.Checklist.ps1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Module/STIG/Functions.Checklist.ps1 b/Module/STIG/Functions.Checklist.ps1 index a5e06bd93..79614fa39 100644 --- a/Module/STIG/Functions.Checklist.ps1 +++ b/Module/STIG/Functions.Checklist.ps1 @@ -641,4 +641,4 @@ function Get-TargetNodeType } } return '' -} \ No newline at end of file +} From 52283134be86ed08d80125cbbcce4f73f37af8d8 Mon Sep 17 00:00:00 2001 From: Brian Wilhite Date: Fri, 20 Dec 2019 10:19:46 -0500 Subject: [PATCH 31/42] prep for 4.2.0 release, update changelog, filehash markdowns and module manifest --- CHANGELOG.md | 2 ++ FILEHASH.md | 82 ++++++++++++++++++++++++++++---------------------- PowerStig.psd1 | 22 ++++++++++++-- 3 files changed, 67 insertions(+), 39 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2f1430b75..f4459028b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,8 @@ ## Unreleased +## 4.2.0 + * Update PowerSTIG parsing for IIS 8.5 STIG - Ver 1, Rel 9: [#530](https://github.com/microsoft/PowerStig/issues/530) * Update PowerSTIG to successfully parse Microsoft .Net Framework STIG 4.0 STIG - Ver 1, Rel 9: [535](https://github.com/microsoft/PowerStig/issues/535) * Update PowerSTIG to successfully parse MS Internet Explorer 11 STIG - Ver 1, Rel 18: [#538](https://github.com/microsoft/PowerStig/issues/538) diff --git a/FILEHASH.md b/FILEHASH.md index 7b9fe09b8..aa595eb47 100644 --- a/FILEHASH.md +++ b/FILEHASH.md @@ -1,4 +1,4 @@ -# PowerSTIG File Hashes : Module Version 4.1.0 +# PowerSTIG File Hashes : Module Version 4.2.0 Hashes for **PowerSTIG** files are listed in the following table: @@ -12,26 +12,26 @@ Hashes for **PowerSTIG** files are listed in the following table: | ActiveDirectory-All-Forest-2.7.xml | DD78DDDD38AF9F5DD90E4A384B3D2670D6C656015E37CB9D11121CA69878E1B4 | 14152 | | ActiveDirectory-All-Forest-2.8.org.default.xml | C1CB80559523FB75483F04349E89E4D2974444A0B8AA8083C8249859EDE0E2BA | 305 | | ActiveDirectory-All-Forest-2.8.xml | BA1C3EC90936413BF04C04FEF83920E550A1E53AD79383F8712DB93D4A80A41D | 14641 | -| DotNetFramework-4-1.7.org.default.xml | 2E20F6E4ACCE26E9D252B8DBDB2DD8936486EA1BA62C2C2743BC16BB269604D1 | 305 | -| DotNetFramework-4-1.7.xml | A45D3E8A2766BEF389C45BA854D62CEA355444DC1658B795C344DE08E1EFAB93 | 51548 | | DotNetFramework-4-1.8.org.default.xml | 2AAB6EFB274E49F158E4B11E31F0A09ED905870C1969A0DD6CEFF1DB237F2A1A | 305 | | DotNetFramework-4-1.8.xml | 44DC3D6E6346B90E75B772ED0CEFF439023E4D8936D09BD375E9A89451F88FBC | 51543 | -| FireFox-All-4.25.org.default.xml | A45477EA90DD426642C752B888C5D8F1F5532FBB3B8879B0A55ED6A20F079A08 | 306 | -| FireFox-All-4.25.xml | 9A3BD2F32F60C978F9EB526E4CD4AC4BF4DB3C90193D4F980E66F35CA59E2726 | 43746 | +| DotNetFramework-4-1.9.org.default.xml | F2F8E5C12242647D644BB273CBD98CA2A150BA4053A1EF4A83237D6C0DF824E9 | 305 | +| DotNetFramework-4-1.9.xml | CE2B27AE9A00166D797C1DA0B1468391556AFF5000A5C11CC807FDF9E9197FF9 | 51522 | | FireFox-All-4.26.org.default.xml | A26E417473AB8FD72BE68D49E0A53C02214F1E448691AF6CDD82DF54AC9F9699 | 306 | | FireFox-All-4.26.xml | 174F11A60985D5D5C6D40423788F694E0A4C400064149A5583CF3DCE242F65AE | 39325 | -| IISServer-8.5-1.6.org.default.xml | 9B49744B2FD527474BDADC0D253F2AB84BE01AE2666E2560DD6DC61336A925A9 | 438 | -| IISServer-8.5-1.6.xml | 62255C7AA8065DE51BC5490C4AB9093D2775B789C67EFE4B24D8373459A140B9 | 116559 | +| FireFox-All-4.27.org.default.xml | 12FC6DFB4CCABFD6D43D4F983BCBF0549C0F3D65B436CAF64DFF31C83B59E02F | 306 | +| FireFox-All-4.27.xml | 8F405BAA320B88226F9C38D87E8FD948324EC2D3E07982C31F2276773BF614C2 | 40846 | | IISServer-8.5-1.7.org.default.xml | ACF3A2FBF19D31CDE937C3680603C6CDE4A8BBC0AC579B363CC6D9E588C3E0ED | 438 | | IISServer-8.5-1.7.xml | A47B96A37505F57592A33EC3F3DE0F2AED5FB173814A9C555E2A428355748418 | 126440 | -| IISSite-8.5-1.7.org.default.xml | 507220C4E3E7FDE4FAB0FE6246018929573C9A7009D403CAFA544FA3171B6E75 | 1441 | -| IISSite-8.5-1.7.xml | B5FF6854D1958ED1B51AF130BE491EF77E22BC4C3FF336497B7D803D295C6842 | 132124 | -| IISSite-8.5-1.8.org.default.xml | 6DF9A7670DA7847BF70C1C7FFC20E8FCE23F57BFDD6D2F05914FDA0B94B1A7CF | 1441 | -| IISSite-8.5-1.8.xml | 60C0D0E814371B31DAADF7582ADADF04C55B2A0DC546D9EC6BBFE82B20CC3A8A | 130356 | -| InternetExplorer-11-1.16.org.default.xml | BDC028F6D224DD78E77CB81658BDF4A63C17C7095B1637A25701834A22344694 | 306 | -| InternetExplorer-11-1.16.xml | 986CE1080783D0E517178B7D60DD204332A5E6727F91E164B5E4F5858F27589C | 334301 | +| IISServer-8.5-1.9.org.default.xml | 891D2D3DA53E8A1241DCE73BF5F02A23FB62F29FBCDC6BE27588C13FBB63E2C7 | 438 | +| IISServer-8.5-1.9.xml | 954E722BAF59B51A1ED2DF701634A804810195F1FC62FFB377B94B29ABA85F0E | 126777 | +| IISSite-8.5-1.8.org.default.xml | 35CC6C2284E002B363F9D888AE20B2A66BD46DD9A80448BA0EAEF4D3B2B65CCE | 1491 | +| IISSite-8.5-1.8.xml | 4BD053CC13A64BB6751225D72F8F3B81B0AB7307F5AAAACE7D24FDDD32FE01DE | 130400 | +| IISSite-8.5-1.9.org.default.xml | BDB889F63903637B7026F231685CC62767DF0B2BD96A6B34D9DCCB52982A4F15 | 1491 | +| IISSite-8.5-1.9.xml | 308E6886D71CE588ABABD420E9F2A7282505E5FE8B2D162FFBFBE5FB55E06143 | 131381 | | InternetExplorer-11-1.17.org.default.xml | 8A5B2D74C0FB37EFBA5C75BADF21955074EA9338062E00BC3C3BF6238BF80F4A | 306 | -| InternetExplorer-11-1.17.xml | 53E849F5D76EDFD275DDBAC5F2298FF2D0BF24C0F3362F9AEE8120A5D11DFC61 | 330200 | +| InternetExplorer-11-1.17.xml | 7BFA9ED087E94EF8314CB6A4B5AE981125483F55CB9583A06D940D4A8D3B2964 | 330080 | +| InternetExplorer-11-1.18.org.default.xml | 1095CEEAD18CBBAD9068326B97D520F7F76F1F71331618F17B2138DC8FE55ED4 | 306 | +| InternetExplorer-11-1.18.xml | 68D731BD29502EF9E519B318FFB4C0584AF92C734277F808D50FB80A87460180 | 332302 | | Office-Excel2013-1.7.org.default.xml | 6A8FBC7AD79015A5261C617A2EFC0084E58BCAFAAD3FA2B8E61BC01A860C102C | 429 | | Office-Excel2013-1.7.xml | D7A0C2FE798EA929BD40DF7FF27324FF8AF2F4C4BD412F9CD4B316A96406DDC0 | 108967 | | Office-Excel2016-1.2.org.default.xml | EE134DCD15DEFBD412AF18477F75248DE83A705E10CA061776F2AE74884749E3 | 530 | @@ -46,51 +46,61 @@ Hashes for **PowerSTIG** files are listed in the following table: | Office-PowerPoint2013-1.6.xml | 563E20C0149E0CB20880EB777439A7B67C4FE1BBF4347EA7677048E6DD2D2EAA | 94142 | | Office-PowerPoint2016-1.1.org.default.xml | 3FEE8C811ED3DB6986E24ABF9BBA833975A908C82EFAECC2E91755E10D02C30C | 431 | | Office-PowerPoint2016-1.1.xml | 8F17DC18B9997782E98DACA5044ACB1E63B178A80240AE130D0AC7F64B703531 | 91626 | +| Office-System2013-1.9.org.default.xml | 45055F756C705090A9F8D6470EF55C2FC8838EA00B2103E372E22B948A06DF63 | 869 | +| Office-System2013-1.9.xml | 346A48CA6FD98889F0E60928AA0E87E138CF4E8A45E1BDB82BB04005428638C5 | 122545 | +| Office-System2016-1.1.org.default.xml | 1BC04F0B3B55ED751A1451845E35821A7A8DE2A9592ED63D70AD422E5B3BB1C4 | 305 | +| Office-System2016-1.1.xml | 6ABE255AD940C70AA20E72B50FCE9E78BA3C3291C085EFF26581059445904229 | 63544 | | Office-Word2013-1.6.org.default.xml | 737AEDF59D64684358B3E58ED4D0C42E5FD99AA4495489B8E625B79CE838E663 | 305 | | Office-Word2013-1.6.xml | 85E667D9899F3B98270275D1E2F1E5BEAF3AC39C0D8F3143E61F53FBA74263B9 | 81466 | | Office-Word2016-1.1.org.default.xml | 7C6CDD5943A445A748835DDAEA1C2AC2615A2BC21B0570751F234E5AB5D7B14B | 431 | | Office-Word2016-1.1.xml | 3309F6DCAFFDC4521E2B40CD6D1FC8DBEFB69972B64BBEC5C4C43BAF74542B84 | 88318 | -| OracleJRE-8-1.5.org.default.xml | 676A5B49ABF068059969EC9C3639788E1606222CA8652628B4D36E2FE1870057 | 305 | -| OracleJRE-8-1.5.xml | 6F340A1C73D32FFC9F1C6699C47BBD3FC6E8B82A95F8816BDDE71B95815AAD31 | 43666 | +| OracleJRE-8-1.5.org.default.xml | 9F29E6AA7A905712FC4BBA768764219CB4CD7F259A0515A486E0E9EE4BE03F66 | 502 | +| OracleJRE-8-1.5.xml | D8D451B6E2B88C4F7FA14809CA7E6485E19C6295460342C01EF78E6787F073F3 | 45264 | | SqlServer-2012-Database-1.18.org.default.xml | 393D9B940BD03BA8F5DB386964D00F1AD9CD195A62D0F654E8235AF8F8754D02 | 409 | | SqlServer-2012-Database-1.18.xml | 6F8DFCC425DDDAB1F6712BE0BB7B996D9D4CA53B64129F3E03131A87186B1362 | 85242 | | SqlServer-2012-Database-1.19.org.default.xml | 68A05F4480CD66C7CB07BF7554A6FB580AD1D7826D56F3B399A164321A5904C5 | 409 | | SqlServer-2012-Database-1.19.xml | 73EBD394A734F4C66077BA9124FD69131986232BB8800EE88509D98CBC471FED | 85752 | -| SqlServer-2012-Instance-1.17.org.default.xml | 213E06833B9AEB53B5E92B2308FEF45636FEC4C7318C695A22BD6B57038763D2 | 775 | -| SqlServer-2012-Instance-1.17.xml | 6E1DB910785ABA34EAF8F4A4458F7CC36BE2748D2B85DAED3A486FAD02CBC8CD | 713286 | -| SqlServer-2012-Instance-1.19.org.default.xml | 9A1073C21CCCAED958DD0654F9F1CFB5AA04C4A9B8352C588BC9DAD7D1FCEF1D | 781 | -| SqlServer-2012-Instance-1.19.xml | 9EB9767A76C46E90DF76008FC95EC79D020190885C91164225DF8D222B3DBDC2 | 720127 | +| SqlServer-2012-Instance-1.17.org.default.xml | 0F9DDEA039A26476C1437F44C9682229DFBAACC8DA9C928A5EA5853539AB7219 | 923 | +| SqlServer-2012-Instance-1.17.xml | C5B91C73E2119F6B0F82212A789571986D07C9479A234119A8B8424AD6FD964C | 712294 | +| SqlServer-2012-Instance-1.19.org.default.xml | 9B26B9AFBF4300D9B66FE4A70D748E030F1F09B3C51D6D926A17A003A25EFC54 | 923 | +| SqlServer-2012-Instance-1.19.xml | 490C90ADBB579E83F54F886CCBC9D62976119925E8D426F18FD8AA8F35D5996C | 719134 | | SqlServer-2016-Instance-1.3.org.default.xml | 16977635610C8B705C2D42C05ABF27151600C781194782872F282663FC9DA95E | 305 | -| SqlServer-2016-Instance-1.3.xml | 4690B3747D05EB4B5DE23AFB37F3C8EDFD86DA241826336FE8A277A43B3914AE | 423742 | -| WindowsClient-10-1.17.org.default.xml | 3D97599EB8327F5D4511AE1BD5CCB1E0DDEA27EAADD928F38FBD6590E0678813 | 3349 | -| WindowsClient-10-1.17.xml | 5655B677C1BD4BFA37308F1EE8169733DD23C344979322E1125CAB3ADE192DE4 | 574357 | +| SqlServer-2016-Instance-1.3.xml | EBDAAECB0DE9766E8EA4A5F87381EA1308571CFC5542228F5E6EA276689DA440 | 424433 | +| SqlServer-2016-Instance-1.7.org.default.xml | 2E20F6E4ACCE26E9D252B8DBDB2DD8936486EA1BA62C2C2743BC16BB269604D1 | 305 | +| SqlServer-2016-Instance-1.7.xml | 3E53AB9F99AD3743D160A6B217078389B0C83C9FE9B469FE716B0A48FF4443B1 | 472997 | | WindowsClient-10-1.18.org.default.xml | EB1149A3E885C09AE0431A2C6F39FC7EB57C8F77BC7238AB6F54D30AF137004C | 3370 | -| WindowsClient-10-1.18.xml | 93116ACBBB25E6DDAC82148EA442E9F8EECA97B7C9CA9BA3CFAA3F22A63F59B5 | 581917 | +| WindowsClient-10-1.18.xml | 64A1FCB57220D56718557FEEAFCF2B067F69E556779FFE55AAEB7DBD72E8A5C4 | 581919 | +| WindowsClient-10-1.19.org.default.xml | 37EFAFAD0D83AD985BA5665CDC056F0EAEB0C0E59A8F901F6A52375D6F12A240 | 3370 | +| WindowsClient-10-1.19.xml | 29EFB639C16BCACD2C91B2467084A52D223E52610D3DD96777AEB637131E2D51 | 581920 | | WindowsDefender-All-1.5.org.default.xml | 0C33C7EA9A2ABDF53F97D730BFFB50501061E91EA6FDD6E1AD56C5955EF0169C | 1170 | -| WindowsDefender-All-1.5.xml | A975F13D38C7800CAB8D0AE145EF9D9DBEBBA41A3EF0142A2DAE6382A3C13821 | 95143 | +| WindowsDefender-All-1.5.xml | 222F39CD3D24B53E290E029580B108E2043397021F520BFBBE6B72E8DB4170F4 | 95102 | | WindowsDefender-All-1.6.org.default.xml | 99B065FCAFEED8B7B087E4AD34D2553A947E6ACD01C8D84BBD66AD8D67B7333A | 1071 | -| WindowsDefender-All-1.6.xml | 1114810E974146F77CB9478F060BB02E7A80E941A0512F02CC9030956330FEB7 | 95077 | +| WindowsDefender-All-1.6.xml | 46AB44C20CAAEF6B5D52FA200564F43FA39D6D29A63AFC533060ED71872B7825 | 95036 | | WindowsDnsServer-2012R2-1.11.org.default.xml | 74831D43FD2564947D69D7EF8EECCC5F192FCA17DED3BA463341EDD20ED3BA58 | 306 | | WindowsDnsServer-2012R2-1.11.xml | DB578A95EBBC65BFAD279D3F55579E056CF9B906B2625065C9F5E2021494F3FF | 267425 | | WindowsDnsServer-2012R2-1.12.org.default.xml | 23FF97A3D83B61CF158A800002286DE35ABCE1E857557A9DB14234F177FA9B32 | 449 | -| WindowsDnsServer-2012R2-1.12.xml | FDA49EAE842AC9BCB3CE1D6D952BA4A2DB8C84375B7193E03C284CA915C55737 | 268042 | +| WindowsDnsServer-2012R2-1.12.xml | 446F82639433F8D50D35642487948B7B4C7B5E61A81400EC36A793948A8AF2BB | 267981 | | WindowsFirewall-All-1.6.org.default.xml | 129A5B9F20B27E36FED4C1AC470B7B7419B563A6B2733B7FC3112CAF682ABB77 | 966 | | WindowsFirewall-All-1.6.xml | 42FA28D3C4BA6387D3EA4F5DCB72F133F814D3A9854555498E22DDFD188194B7 | 65518 | | WindowsFirewall-All-1.7.org.default.xml | 64E9FFA9B456C36DD36B5824BF641E473931B5C350F473DDFFDF31B1B64DD016 | 966 | | WindowsFirewall-All-1.7.xml | BBB13C6D675EB591D972EF8AD9B46472CFE80FCAD76E9D453586E6BE430F01B6 | 65518 | -| WindowsServer-2012R2-DC-2.16.org.default.xml | 1EA46D2A8F2BBCEBD0AD2C16CC840F51DDEA6F36064D62FBF058BD186ADE8054 | 4532 | -| WindowsServer-2012R2-DC-2.16.xml | 23D9F976FFA4FED43FC0ADBA43B8CE6561EBF547D0890463005E9DE11F05E063 | 775120 | | WindowsServer-2012R2-DC-2.17.org.default.xml | AB4EF5C627A56EA58B0A27C53882A742A330C86937B7C5053A90CE0605053525 | 4532 | -| WindowsServer-2012R2-DC-2.17.xml | A5220FB9683644A1EC1122B6FA714E11A1C22540D98CB795CE897246B3A6B218 | 773627 | -| WindowsServer-2012R2-MS-2.15.org.default.xml | 15E575CCA42360C7DF9DDF9B8AEF6CD98F523054497F385C70A73B6373190D2A | 3988 | -| WindowsServer-2012R2-MS-2.15.xml | 2F33DCADAA9E112EE23A0C4F23F3426B76DCA654B6186C551F62AE2BDEA12D37 | 660266 | +| WindowsServer-2012R2-DC-2.17.xml | 2E89F2BCFE21180EA09410B75A4C83FA4E35F0009BB254BA9B0EDB5758768F41 | 768136 | +| WindowsServer-2012R2-DC-2.18.org.default.xml | AB84D6DBD15D709B1710851F7D758120132ED1177AA5B52A118DE85B6971563A | 4532 | +| WindowsServer-2012R2-DC-2.18.xml | 02F450A63656DBD538F9381CD5E6C08F71EDFCBBAAC094DC8B79D81B1A10AE19 | 768234 | | WindowsServer-2012R2-MS-2.16.org.default.xml | 506B11E8DF549F7303C929BE63FC567C69E31A0F80FA3BC712BDBAE2CF3723EB | 3988 | | WindowsServer-2012R2-MS-2.16.xml | 35F9B511C263D257263C9C75E9C18F48B97A5DC3FF94AAD786ACF6FF814F9EA1 | 662064 | +| WindowsServer-2012R2-MS-2.17.org.default.xml | 08D9CB2948D6070F75D95D7AE932E318265ECEFC58ED76C4BE416DDE82BC75A7 | 3988 | +| WindowsServer-2012R2-MS-2.17.xml | C3EEE623399D2D37379E5159280D77BFEE9A0B16D3D9CFE6D9F11F4818AE6E24 | 662162 | | WindowsServer-2016-DC-1.8.org.default.xml | 4D7EEDE652E793EB8773788E4CB2F1F056708943E8DB22671477AA42E09CFC43 | 3771 | -| WindowsServer-2016-DC-1.8.xml | 00B1629B610C2377C04AF9357AE1103FE18F1906C8B92A976C07FF239DFC2509 | 561551 | -| WindowsServer-2016-DC-1.9.org.default.xml | F139E6B861715B0870F3236A8292D6704F2DA84A317B26BB1C02E99E6A99DA10 | 3771 | -| WindowsServer-2016-DC-1.9.xml | CF31F0CB8DEAB839BFC02FC03A95ADCC38F6FBAA822F021A33FA3AD89612E3C3 | 556472 | +| WindowsServer-2016-DC-1.8.xml | E8D9EF11DB2C5F5A324567D5D1EFEDBB8178382687E8D3BDFE24FDEAE8A4CB07 | 550373 | +| WindowsServer-2016-DC-1.9.org.default.xml | 446EBD5DFB5C597A6095A1A98864DED1E7F2991022FD97B6C454902B10094DDB | 3672 | +| WindowsServer-2016-DC-1.9.xml | B5E16B5ACF73BDD02C5061D559BE9AC9D075DE420173830FC844875680443025 | 548332 | | WindowsServer-2016-MS-1.8.org.default.xml | BB8F18A83CE803D1D8348F152D2AFF839EE46465C4243B129C52B8F4018B3381 | 3887 | | WindowsServer-2016-MS-1.8.xml | 20DF2D3ABE3F37444F83F0AEFBE5204EDC37FD1DDA82391303DBF17B0B5FEB31 | 473734 | -| WindowsServer-2016-MS-1.9.org.default.xml | 43EACE83E712F590EF96911CC47107F1006F28A28E6DE7E7C52BFA6C8C51B5D7 | 3887 | +| WindowsServer-2016-MS-1.9.org.default.xml | 0B3A27BF774196AC1D47050BFF0D5EC3C9AC60BAE1ED89E750044CFFDAD446A7 | 3788 | | WindowsServer-2016-MS-1.9.xml | 496CBDC4CED3C2E41820C880C2A8BBD6FCBA7DD41BEB685E50F84BCD23F9A926 | 469746 | +| WindowsServer-2019-DC-1.2.org.default.xml | DC693296EBFAD2FBA7AE4FE72456D1E1AA812890797FD296235DE8EA3D79FB1B | 3625 | +| WindowsServer-2019-DC-1.2.xml | E7703406D013CEB6C89A4AC1FB0F658FBD6A6649AADC65D6F9A459BE9B0FDC92 | 619120 | +| WindowsServer-2019-MS-1.2.org.default.xml | 2FE6BA7A6D8EE772DF1A248B51A92D63F55F0D9B01956127EA7DA230A6B32598 | 3563 | +| WindowsServer-2019-MS-1.2.xml | C9D44B26E2C9C3C957E2DBCF97329D5844E256CAB203E1A20A41BDFB65EC4474 | 541445 | diff --git a/PowerStig.psd1 b/PowerStig.psd1 index 07ad9c715..3c2af6c9c 100644 --- a/PowerStig.psd1 +++ b/PowerStig.psd1 @@ -6,7 +6,7 @@ RootModule = 'PowerStig.psm1' # Version number of this module. -ModuleVersion = '4.1.1' +ModuleVersion = '4.2.0' # ID used to uniquely identify this module GUID = 'a132f6a5-8f96-4942-be25-b213ee7e4af3' @@ -72,7 +72,7 @@ FunctionsToExport = @( 'Get-DomainName', 'Get-Stig', 'New-StigCheckList' -) +) # Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export. CmdletsToExport = @() @@ -98,7 +98,23 @@ PrivateData = @{ ProjectUri = 'https://github.com/Microsoft/PowerStig' # ReleaseNotes of this module - ReleaseNotes = '* Fixed [#517](https://github.com/microsoft/PowerStig/issues/517): 4.1.0 GPRegistryPolicyDsc Module Version Issue' + ReleaseNotes = '* Update PowerSTIG parsing for IIS 8.5 STIG - Ver 1, Rel 9: [#530](https://github.com/microsoft/PowerStig/issues/530) + * Update PowerSTIG to successfully parse Microsoft .Net Framework STIG 4.0 STIG - Ver 1, Rel 9: [535](https://github.com/microsoft/PowerStig/issues/535) + * Update PowerSTIG to successfully parse MS Internet Explorer 11 STIG - Ver 1, Rel 18: [#538](https://github.com/microsoft/PowerStig/issues/538) + * Update PowerSTIG to successfully parse Mozilla Firefox STIG - Ver 4, Rel 27: [#540](https://github.com/microsoft/PowerStig/issues/540) + * Update PowerSTIG to successfully parse Microsoft Windows 10 STIG - Ver 1, Rel 19: [533](https://github.com/microsoft/PowerStig/issues/533) + * Update PowerSTIG to parse/convert the Windows Server 2012 R2 MS/DC V2R17/V2R18 Respectively: [531](https://github.com/microsoft/PowerStig/issues/531) + * Update PowerSTIG to successfully parse Microsoft SQL Server 2016 Instance STIG - Ver 1, Rel 7: [#542](https://github.com/microsoft/PowerStig/issues/542) + * Update PowerSTIG to parse and apply OfficeSystem 2013 STIG V1R9 / 2016 V1R1: [#551](https://github.com/microsoft/PowerStig/issues/551) + * Update PowerSTIG to parse and apply Windows Server 2019 V1R2 STIG: [#554](https://github.com/microsoft/PowerStig/issues/554) + * Fixed [#428](https://github.com/microsoft/PowerStig/issues/428): Updated JRE rule V-66941.a to be a Organizational setting + * Fixed [#427](https://github.com/microsoft/PowerStig/issues/427): Windows 10 Rule V-63373 fails to apply settings to system drive + * Fixed [#514](https://github.com/microsoft/PowerStig/issues/514): Feature request: additional support for servicerule properties + * Fixed [#521](https://github.com/microsoft/PowerStig/issues/521): Organizational setting warning should include Stig name + * Fixed [#443](https://github.com/microsoft/PowerStig/issues/443): Missing cmdlet Get-StigXccdfBenchmark function + * Fixed [#528](https://github.com/microsoft/PowerStig/issues/528): New-StigChecklist should not require a ManualCheckFile + * Fixed [#545](https://github.com/microsoft/PowerStig/issues/545): Need a test to verify the conversionstatus="fail" does not exist in processed STIGs + * Fixed [#517](https://github.com/microsoft/PowerStig/issues/520): Need a test to verify the module version in the module manifest matches the DscResources.' } # End of PSData hashtable } # End of PrivateData hashtable } From b0d3751ac1062d4af172a46cba152aa8a06b2b7d Mon Sep 17 00:00:00 2001 From: Steve Hose <33662177+stevehose@users.noreply.github.com> Date: Fri, 20 Dec 2019 11:10:51 -0500 Subject: [PATCH 32/42] Fix for build missing functions reference --- Tests/Integration/.tests.header.ps1 | 3 +++ Tests/Unit/Module/Common.tests.ps1 | 1 - Tests/Unit/Module/STIG.tests.ps1 | 1 - 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/Tests/Integration/.tests.header.ps1 b/Tests/Integration/.tests.header.ps1 index f91e172c9..3e0010db4 100644 --- a/Tests/Integration/.tests.header.ps1 +++ b/Tests/Integration/.tests.header.ps1 @@ -6,3 +6,6 @@ $script:modulePath = "$($script:moduleRoot)\$($script:moduleName).psm1" $helperModulePath = Join-Path -Path $script:moduleRoot -ChildPath 'Tools\TestHelper\TestHelper.psm1' Import-Module $helperModulePath -Force Import-Module $script:modulePath -Force + +$coreModulePath = Join-Path -path $script:moduleRoot -ChildPath 'PowerStig.psm1' +Import-Module $coreModulePath -Force diff --git a/Tests/Unit/Module/Common.tests.ps1 b/Tests/Unit/Module/Common.tests.ps1 index 78e0ec799..0cb18da6d 100644 --- a/Tests/Unit/Module/Common.tests.ps1 +++ b/Tests/Unit/Module/Common.tests.ps1 @@ -1,5 +1,4 @@ using module .\..\..\..\Module\Common\Common.psm1 -. $PSScriptRoot\..\..\..\Module\Stig\Functions.XccdfXml.ps1 . $PSScriptRoot\.tests.header.ps1 # Header #region Enum Tests diff --git a/Tests/Unit/Module/STIG.tests.ps1 b/Tests/Unit/Module/STIG.tests.ps1 index b9fe72eb6..5f79ae8fc 100644 --- a/Tests/Unit/Module/STIG.tests.ps1 +++ b/Tests/Unit/Module/STIG.tests.ps1 @@ -1,6 +1,5 @@ #region Header using module .\..\..\..\Module\STIG\Convert\Convert.Main.psm1 -. $PSScriptRoot\..\..\..\Module\STIG\Functions.XccdfXml.ps1 . $PSScriptRoot\.tests.header.ps1 #endregion try From 2e2e334bb7058a247feb1282caa45421e19060d0 Mon Sep 17 00:00:00 2001 From: Steve Hose <33662177+stevehose@users.noreply.github.com> Date: Fri, 20 Dec 2019 12:54:20 -0500 Subject: [PATCH 33/42] Relocated file to be picked up during runtime --- Module/{STIG => Common}/Functions.XccdfXml.ps1 | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename Module/{STIG => Common}/Functions.XccdfXml.ps1 (100%) diff --git a/Module/STIG/Functions.XccdfXml.ps1 b/Module/Common/Functions.XccdfXml.ps1 similarity index 100% rename from Module/STIG/Functions.XccdfXml.ps1 rename to Module/Common/Functions.XccdfXml.ps1 From a6169bb3824d742eb812970b6f5fab2600d21f77 Mon Sep 17 00:00:00 2001 From: Steve Hose <33662177+stevehose@users.noreply.github.com> Date: Fri, 20 Dec 2019 12:56:52 -0500 Subject: [PATCH 34/42] Minor update to remove test code --- Tests/Integration/.tests.header.ps1 | 3 --- 1 file changed, 3 deletions(-) diff --git a/Tests/Integration/.tests.header.ps1 b/Tests/Integration/.tests.header.ps1 index 3e0010db4..f91e172c9 100644 --- a/Tests/Integration/.tests.header.ps1 +++ b/Tests/Integration/.tests.header.ps1 @@ -6,6 +6,3 @@ $script:modulePath = "$($script:moduleRoot)\$($script:moduleName).psm1" $helperModulePath = Join-Path -Path $script:moduleRoot -ChildPath 'Tools\TestHelper\TestHelper.psm1' Import-Module $helperModulePath -Force Import-Module $script:modulePath -Force - -$coreModulePath = Join-Path -path $script:moduleRoot -ChildPath 'PowerStig.psm1' -Import-Module $coreModulePath -Force From 51a6812ac140059e5cf1ff55862c8c14d1c360e2 Mon Sep 17 00:00:00 2001 From: Steve Hose <33662177+stevehose@users.noreply.github.com> Date: Sat, 21 Dec 2019 12:42:36 -0500 Subject: [PATCH 35/42] Updated for build errors --- CHANGELOG.md | 1 + .../U_MS_SQL_Server_2016_Instance_STIG_V1R3_Manual-xccdf.log | 1 + .../U_MS_SQL_Server_2016_Instance_STIG_V1R7_Manual-xccdf.log | 1 + 3 files changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 46cda8e36..1343a1d7a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,7 @@ # Versions ## Unreleased + * Fixed [#259](https://github.com/microsoft/PowerStig/issues/259): Checklist .ckl file fails XML validation in Stig Viewer 2.8. * Fixed [#527](https://github.com/microsoft/PowerStig/issues/527): Checklist is not using manualcheckfile when using DscResult. * Fixed [#548](https://github.com/microsoft/PowerStig/issues/548): Target/host data is blank when creating a new checklist. diff --git a/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R3_Manual-xccdf.log b/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R3_Manual-xccdf.log index 26bc4e879..2a21cb556 100644 --- a/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R3_Manual-xccdf.log +++ b/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R3_Manual-xccdf.log @@ -1,2 +1,3 @@ +V-79141::*::'' V-79197::If "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding. ::If the value for "System_cryptography_Use_FIPS_compliant_algorithms_for_encryption_hashing_and_signing" is not "enabled", this is a finding. V-79213::Local Security Policy >> Local Policies >> Security Options::"" diff --git a/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R7_Manual-xccdf.log b/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R7_Manual-xccdf.log index 4f8c262b2..ec7530da0 100644 --- a/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R7_Manual-xccdf.log +++ b/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R7_Manual-xccdf.log @@ -1,3 +1,4 @@ +V-79141::*::'' V-79197::If "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding.::If the value for "System_cryptography_Use_FIPS_compliant_algorithms_for_encryption_hashing_and_signing" is not "enabled", this is a finding. V-79213::Local Security Policy >> Local Policies >> Security Options::"" V-97521::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 3.0\Client'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 3.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 3.0\Client'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 3.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'Dword'} From 0ee6e547d626468b527a2033f93ca374fe9b596f Mon Sep 17 00:00:00 2001 From: Steve Hose <33662177+stevehose@users.noreply.github.com> Date: Sat, 21 Dec 2019 14:05:01 -0500 Subject: [PATCH 36/42] Updated processed SQL Server 1.3 files --- ...qlServer-2016-Instance-1.3.org.default.xml | 13 +--- .../Processed/SqlServer-2016-Instance-1.3.xml | 72 ++++++------------- 2 files changed, 24 insertions(+), 61 deletions(-) diff --git a/StigData/Processed/SqlServer-2016-Instance-1.3.org.default.xml b/StigData/Processed/SqlServer-2016-Instance-1.3.org.default.xml index fb45b2556..228a174df 100644 --- a/StigData/Processed/SqlServer-2016-Instance-1.3.org.default.xml +++ b/StigData/Processed/SqlServer-2016-Instance-1.3.org.default.xml @@ -5,15 +5,4 @@ Each setting in this file is linked by STIG ID and the valid range is in an associated comment. --> - - - - - - - - - - - - + diff --git a/StigData/Processed/SqlServer-2016-Instance-1.3.xml b/StigData/Processed/SqlServer-2016-Instance-1.3.xml index af417948c..3fe110b23 100644 --- a/StigData/Processed/SqlServer-2016-Instance-1.3.xml +++ b/StigData/Processed/SqlServer-2016-Instance-1.3.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>Database management includes the ability to control the number of users and user sessions utilizing SQL Server. Unlimited concurrent connections to SQL Server could allow a successful Denial of Service (DoS) attack by exhausting connection resources; and a system can also fail or be degraded by an overload of legitimate users. Limiting the number of concurrent sessions per user is helpful in reducing these risks. @@ -2757,40 +2757,14 @@ For more information, see https://support.microsoft.com/en-us/kb/3141890. - - <VulnDiscussion>Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation for the whole time SQL Server is running.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 - False - False - - When Audits are enabled, they start up when the instance starts. -https://msdn.microsoft.com/en-us/library/cc280386.aspx#Anchor_2 - -Check if an audit is configured and enabled. - -Execute the following query: - -SELECT name AS 'Audit Name', -status_desc AS 'Audit Status', -audit_file_path AS 'Current Audit File' -FROM sys.dm_server_audit_status -WHERE status_desc = 'STARTED' - -All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 - - - <VulnDiscussion>Without auditing the enforcement of access restrictions against changes to configuration, it would be difficult to identify attempted attacks and an audit trail would not be available for forensic investigation for after-the-fact actions. Enforcement actions are the methods or mechanisms used to prevent unauthorized changes to configuration settings. Enforcement action methods may be as simple as denying access to a file based on the application of file permissions (access restriction). Audit items may consist of lists of actions blocked by access restrictions or changes identified after the fact.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_ACCESS_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_ACCESS_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False - True + False Determine if an audit is configured to capture denied actions and started by executing the following query: @@ -2883,7 +2857,7 @@ If the identified groups are not returned, this is a finding. In an SQL environment, adding permissions is typically done via the GRANT command, or, in the negative, the DENY command.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -2917,7 +2891,7 @@ In an SQL environment, adding permissions is typically done via the GRANT comman To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> V-79259 - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -2949,7 +2923,7 @@ https://msdn.microsoft.com/en-us/library/cc280663.aspx In an SQL environment, modifying permissions is typically done via the GRANT, REVOKE, and DENY commands.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> V-79259 - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -2983,7 +2957,7 @@ In an SQL environment, modifying permissions is typically done via the GRANT, RE To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> V-79259 - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3038,7 +3012,7 @@ JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.s WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 @@ -3073,7 +3047,7 @@ JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.s WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 @@ -3083,7 +3057,7 @@ If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is In an SQL environment, deleting permissions is typically done via the REVOKE or DENY command.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> V-79259 - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3117,7 +3091,7 @@ In an SQL environment, deleting permissions is typically done via the REVOKE or To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> V-79259 - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3172,7 +3146,7 @@ JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.s WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 @@ -3207,7 +3181,7 @@ JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.s WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'SCHEMA_OBJECT_CHANGE_GROUP' If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 @@ -3215,9 +3189,9 @@ If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is <VulnDiscussion>For completeness of forensic analysis, it is necessary to track who/what (a user or other principal) logs on to SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('SUCCESSFUL_LOGIN_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (SUCCESSFUL_LOGIN_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False - True + False Determine if an audit is configured and started by executing the following query. @@ -3281,7 +3255,7 @@ JOIN sys.server_audit_specification_details d ON s.server_specification_id = d.s WHERE a.is_state_enabled = 1 AND d.audit_action_name = 'FAILED_LOGIN_GROUP' If the "FAILED_LOGIN_GROUP" is not returned in an active audit, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 @@ -3316,9 +3290,9 @@ Depending on the capabilities of SQL Server and the design of the database and a Note that it is particularly important to audit, and tightly control, any action that weakens the implementation of this requirement itself, since the objective is to have a complete audit trail of all administrative activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False - True + False Determine if an audit is configured and started by executing the following query: @@ -3394,7 +3368,7 @@ Note that it is particularly important to audit, and tightly control, any action To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> V-79291 - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3460,7 +3434,7 @@ If the identified groups are not returned, this is a finding. Disconnection may be initiated by the user or forced by the system (as in a timeout) or result from a system or network failure. To the greatest extent possible, all disconnections must be logged.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> V-79291 - USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 + USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP),(AUDIT_CHANGE_GROUP),(BACKUP_RESTORE_GROUP),(DATABASE_CHANGE_GROUP),(DATABASE_OBJECT_CHANGE_GROUP),(DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP),(DATABASE_OBJECT_PERMISSION_CHANGE_GROUP),(DATABASE_OPERATION_GROUP),(DATABASE_OWNERSHIP_CHANGE_GROUP),(DATABASE_PERMISSION_CHANGE_GROUP),(DATABASE_PRINCIPAL_CHANGE_GROUP),(DATABASE_PRINCIPAL_IMPERSONATION_GROUP),(DATABASE_ROLE_MEMBER_CHANGE_GROUP),(DBCC_GROUP),(LOGIN_CHANGE_PASSWORD_GROUP),(SCHEMA_OBJECT_CHANGE_GROUP),(SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP),(SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OBJECT_CHANGE_GROUP),(SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP),(SERVER_OBJECT_PERMISSION_CHANGE_GROUP),(SERVER_OPERATION_GROUP),(SERVER_PERMISSION_CHANGE_GROUP),(SERVER_PRINCIPAL_CHANGE_GROUP),(SERVER_PRINCIPAL_IMPERSONATION_GROUP),(SERVER_ROLE_MEMBER_CHANGE_GROUP),(SERVER_STATE_CHANGE_GROUP),(TRACE_CHANGE_GROUP),(USER_CHANGE_PASSWORD_GROUP) /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False False @@ -3560,7 +3534,7 @@ In SQL Management Studio: Right-click on the instance >> Select "Properties" >> Select "Security" on the left hand side >> Check the setting for "Login auditing" If "Both failed and successful logins" is not selected, this is a finding. - /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = '($auditPath)', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); + /* See STIG supplemental files for the annotated version of this script */ USE [master] IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audit_specifications WHERE name = 'STIG_AUDIT_SERVER_SPECIFICATION') DROP SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION; IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = OFF); IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') DROP SERVER AUDIT STIG_AUDIT; CREATE SERVER AUDIT STIG_AUDIT TO FILE (FILEPATH = 'C:\Audits', MAXSIZE = 200MB, MAX_ROLLOVER_FILES = 50, RESERVE_DISK_SPACE = OFF) WITH (QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN) IF EXISTS (SELECT 1 FROM sys.server_audits WHERE name = 'STIG_AUDIT') ALTER SERVER AUDIT STIG_AUDIT WITH (STATE = ON); CREATE SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION FOR SERVER AUDIT STIG_AUDIT ADD (APPLICATION_ROLE_CHANGE_PASSWORD_GROUP), ADD (AUDIT_CHANGE_GROUP), ADD (BACKUP_RESTORE_GROUP), ADD (DATABASE_CHANGE_GROUP), ADD (DATABASE_OBJECT_CHANGE_GROUP), ADD (DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_OBJECT_PERMISSION_CHANGE_GROUP), ADD (DATABASE_OPERATION_GROUP), ADD (DATABASE_OWNERSHIP_CHANGE_GROUP), ADD (DATABASE_PERMISSION_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_CHANGE_GROUP), ADD (DATABASE_PRINCIPAL_IMPERSONATION_GROUP), ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP), ADD (DBCC_GROUP), ADD (FAILED_LOGIN_GROUP), ADD (LOGIN_CHANGE_PASSWORD_GROUP), ADD (LOGOUT_GROUP), ADD (SCHEMA_OBJECT_CHANGE_GROUP), ADD (SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OBJECT_CHANGE_GROUP), ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP), ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP), ADD (SERVER_OPERATION_GROUP), ADD (SERVER_PERMISSION_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP), ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP), ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP), ADD (SERVER_STATE_CHANGE_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (TRACE_CHANGE_GROUP) WITH (STATE = ON); GO USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES () /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 @@ -3574,7 +3548,7 @@ Some applications that run on SQL Server require the [sa] account to be enabled USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled <> 1; False - True + False Check SQL Server settings to determine if the [sa] (system administrator) account has been disabled by executing the following query: @@ -3600,7 +3574,7 @@ Since the SQL Server [sa] is administrative in nature, the compromise of a defau V-79317 USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled <> 1; False - True + False Verify the SQL Server default [sa] (system administrator) account name has been changed by executing the following query: From a927bfceb5dc5503609302f75c28f306a1d815cf Mon Sep 17 00:00:00 2001 From: Steve Hose <33662177+stevehose@users.noreply.github.com> Date: Wed, 8 Jan 2020 16:48:59 -0500 Subject: [PATCH 37/42] Updates for PR --- Module/Common/Functions.XccdfXml.ps1 | 48 +++++++++++++++++++--------- 1 file changed, 33 insertions(+), 15 deletions(-) diff --git a/Module/Common/Functions.XccdfXml.ps1 b/Module/Common/Functions.XccdfXml.ps1 index 67a6f388b..ec8d4ba0e 100644 --- a/Module/Common/Functions.XccdfXml.ps1 +++ b/Module/Common/Functions.XccdfXml.ps1 @@ -35,19 +35,19 @@ function Split-StigXccdf $Destination ) - Begin + begin { - $CurrentVerbosePreference = $global:VerbosePreference + $currentVerbosePreference = $global:VerbosePreference if ($PSBoundParameters.ContainsKey('Verbose')) { $global:VerbosePreference = 'Continue' } } - Process + process { # Get the raw xccdf xml to pull additional details from the root node. - [xml] $msStig = Get-Content -Path $path + [xml] $msStig = Get-Content -Path $Path [xml] $dcStig = $msStig.Clone() # Update the benchmark ID to reflect the STIG content @@ -56,6 +56,7 @@ function Split-StigXccdf # Remove DC and Core settings from the MS xml Write-Information -MessageData "Removing Domain Controller and Core settings from Member Server STIG" + foreach ($group in $msStig.Benchmark.Group) { # Remove DC only settings from the MS xml @@ -78,6 +79,7 @@ function Split-StigXccdf # Remove Core and MS only settings from the DC xml Write-Information -MessageData "Removing Member Server settings from Domain Controller STIG" + foreach ($group in $dcStig.Benchmark.Group) { # Remove MS only settings from DC XML @@ -100,21 +102,21 @@ function Split-StigXccdf if ([string]::IsNullOrEmpty($Destination)) { - $Destination = Split-Path -Path $path -Parent + $Destination = Split-Path -Path $Path -Parent } else { $Destination = $Destination.TrimEnd("\") } - $FilePath = "$Destination\$(Split-Path -Path $path -Leaf)" + $filePath = "$Destination\$(Split-Path -Path $Path -Leaf)" - $msStig.Save(($FilePath -replace '_STIG_', '_MS_STIG_')) - $dcStig.Save(($FilePath -replace '_STIG_', '_DC_STIG_')) + $msStig.Save(($filePath -replace '_STIG_', '_MS_STIG_')) + $dcStig.Save(($filePath -replace '_STIG_', '_DC_STIG_')) } - End + end { - $global:VerbosePreference = $CurrentVerbosePreference + $global:VerbosePreference = $currentVerbosePreference } } @@ -125,15 +127,19 @@ function Split-StigXccdf .SYNOPSIS Get-StigRuleList determines what type of STIG setting is being processed and sends it to a specalized function for additional processing. + .DESCRIPTION Get-StigRuleList pre-sorts the STIG rules that is recieves and tries to determine what type of object it should create. For example if the check content has the string HKEY, it assumes that the setting is a registry object and sends the check to the registry sub functions to further break down the string into a registry object. + .PARAMETER StigGroupList An array of the child STIG Group elements from the parent Benchmark element in the xccdf. + .PARAMETER IncludeRawString A flag that returns the unaltered Check-Content with the converted object. + .NOTES General notes #> @@ -180,10 +186,10 @@ function Get-StigRuleList foreach ($correction in $StigGroupListChangeLog[$stigRule.Id]) { - # If the logfile contains a single * as the OldText, treat it as replacing everything with the newText value + # If the logfile contains a single * as the OldText, treat it as replacing everything with the newText value. if ($correction.OldText -eq '*') { - # Resetting OldText '' to the original check-content so the processed xml includes original check-content + # Resetting OldText '' to the original check-content so the processed xml includes original check-content. $correction.OldText = $stigRule.rule.Check.('check-content') $stigRule.rule.Check.('check-content') = $correction.newText } @@ -192,6 +198,7 @@ function Get-StigRuleList $stigRule.rule.Check.('check-content') = $stigRule.rule.Check.('check-content').Replace($correction.oldText, $correction.newText) } } + $rules = [ConvertFactory]::Rule($stigRule) foreach ($rule in $rules) @@ -224,6 +231,7 @@ function Get-StigRuleList { [void] $global:stigSettings.Add($rule) } + } $stigProcessedCounter ++ } @@ -232,15 +240,19 @@ function Get-StigRuleList { $global:stigSettings } + } <# .SYNOPSIS Creates the file name to create from the xccdf content + .PARAMETER StigDetails A reference to the in memory xml document. + .NOTES This function should only be called from the public ConvertTo-DscStigXml function. + #> function Get-PowerStigFileList { @@ -275,7 +287,6 @@ function Get-PowerStigFileList } else { - #$Destination = "$(Split-Path -Path (Split-Path -Path (Split-Path -Path $PSScriptRoot)))\StigData\Processed" $Destination = "$(Split-Path -Path (Split-Path -Path $PSScriptRoot))\StigData\Processed" } @@ -290,10 +301,13 @@ function Get-PowerStigFileList <# .SYNOPSIS Splits the Xccdf benchmark ID into an object. + .PARAMETER Id The Id field from the Xccdf benchmark. + .PARAMETER FilePath Specifies the file path to the xccdf. Used to determine technology role in SQL STIGs + #> function Split-BenchmarkId { @@ -307,7 +321,7 @@ function Split-BenchmarkId [Parameter()] [string] - $FilePath + $filePath ) # Different STIG's present the Id field in a different format. @@ -349,7 +363,7 @@ function Split-BenchmarkId {$PSItem -match "SQL_Server"} { # The metadata does not differentiate between the database and instance STIG so we have to get that from the file name. - $sqlRole = Get-SqlTechnologyRole -Path $FilePath + $sqlRole = Get-SqlTechnologyRole -Path $filePath $returnId = $id -replace ($sqlServerVariations -join '|'), 'SqlServer' $returnId = $returnId -replace ($sqlServerInstanceVariations -join '|'), $sqlRole @@ -464,10 +478,13 @@ function Get-SqlTechnologyRole <# .SYNOPSIS Creates a version number from the xccdf benchmark element details. + .PARAMETER stigDetails A reference to the in memory xml document. + .NOTES This function should only be called from the public ConvertTo-DscStigXml function. + #> function Get-StigVersionNumber { @@ -485,6 +502,7 @@ function Get-StigVersionNumber -split "(Release:)(.*?)(Benchmark)" )[2].trim() "$($StigDetails.Benchmark.version).$revision" + } #endregion From b25ef867f520aa199b63fce8946b03ae4f9c946c Mon Sep 17 00:00:00 2001 From: Steve Hose <33662177+stevehose@users.noreply.github.com> Date: Wed, 8 Jan 2020 17:06:36 -0500 Subject: [PATCH 38/42] Updates for PR --- .../STIG/Convert/Functions.PowerStigXml.ps1 | 16 +++++----- Module/STIG/Functions.Checklist.ps1 | 30 ++++++++++++++----- 2 files changed, 30 insertions(+), 16 deletions(-) diff --git a/Module/STIG/Convert/Functions.PowerStigXml.ps1 b/Module/STIG/Convert/Functions.PowerStigXml.ps1 index b7b0c1236..7effe4210 100644 --- a/Module/STIG/Convert/Functions.PowerStigXml.ps1 +++ b/Module/STIG/Convert/Functions.PowerStigXml.ps1 @@ -127,7 +127,7 @@ function Get-RegistryRuleExpressions $StigBenchmarkXml ) - Begin + begin { # Use $stigBenchmarkXml.id to determine the stig file $benchmarkId = Split-BenchmarkId $stigBenchmarkXml.id @@ -164,7 +164,7 @@ function Get-RegistryRuleExpressions } } - Process + process { # Load specific and core expression sets $childItemParams = @{ @@ -231,7 +231,7 @@ function ConvertTo-PowerStigXml $DoNotExportDescription ) - Begin + begin { $CurrentVerbosePreference = $global:VerbosePreference @@ -240,7 +240,7 @@ function ConvertTo-PowerStigXml $global:VerbosePreference = 'Continue' } } - Process + process { $convertedStigObjects = ConvertFrom-StigXccdf -Path $Path -RuleIdFilter $RuleIdFilter @@ -442,7 +442,7 @@ function ConvertTo-PowerStigXml Write-Output "Org Settings Output: $($fileList.OrgSettings.FullName)" } } - End + end { $global:VerbosePreference = $CurrentVerbosePreference } @@ -474,7 +474,7 @@ function Compare-PowerStigXml [switch] $IgnoreRawString ) - Begin + begin { $CurrentVerbosePreference = $global:VerbosePreference @@ -483,7 +483,7 @@ function Compare-PowerStigXml $global:VerbosePreference = 'Continue' } } - Process + process { [xml] $OldStigContent = Get-Content -Path $OldStigPath -Encoding UTF8 @@ -556,7 +556,7 @@ function Compare-PowerStigXml } $returnCompareList.GetEnumerator() | Sort-Object Name } - End + end { $global:VerbosePreference = $CurrentVerbosePreference } diff --git a/Module/STIG/Functions.Checklist.ps1 b/Module/STIG/Functions.Checklist.ps1 index 79614fa39..b6d62dd2b 100644 --- a/Module/STIG/Functions.Checklist.ps1 +++ b/Module/STIG/Functions.Checklist.ps1 @@ -98,7 +98,7 @@ function New-StigCheckList } $TargetNode = $DscResult.PSComputerName } - + $TargetNodeType = Get-TargetNodeType($TargetNode) switch ($TargetNodeType) @@ -214,9 +214,10 @@ function New-StigCheckList [xml]$xccdfBenchmark = Get-Content -Path $xccdfPath -Encoding UTF8 $fileList = Get-PowerStigFileList -StigDetails $xccdfBenchmark $processedFileName = $fileList.Settings.FullName - [xml]$processed = get-content -Path $processedFileName + [xml]$processed = Get-Content -Path $processedFileName $vulnerabilities = Get-VulnerabilityList -XccdfBenchmark $xccdfBenchmarkContent + foreach ($vulnerability in $vulnerabilities) { $writer.WriteStartElement("VULN") @@ -278,13 +279,16 @@ function New-StigCheckList } elseif ($PSCmdlet.ParameterSetName -eq 'result') { - $manualCheck = $manualCheckData | Where-Object {$_.VulID -eq $VID} + $manualCheck = $manualCheckData | Where-Object -FilterScript {$_.VulID -eq $VID} # If we have manual check data, we don't need to look at the configuration - if ($manualCheck){ + if ($manualCheck) + { $status = $statusMap["$($manualCheck.Status)"] $findingDetails = $manualCheck.Details $comments = $manualCheck.Comments - } else { + } + else + { $setting = Get-SettingsFromResult -DscResult $dscResult -Id $vid if ($setting) { @@ -314,12 +318,14 @@ function New-StigCheckList # Test to see if this rule is managed as a duplicate $convertedRule = $processed.SelectSingleNode("//Rule[@id='$vid']") + if ($convertedRule.DuplicateOf) { # How is the duplicate rule handled? If it is handled, then this duplicate is also covered if ($PSCmdlet.ParameterSetName -eq 'mof') { $originalSetting = Get-SettingsFromMof -ReferenceConfiguration $referenceConfiguration -Id $convertedRule.DuplicateOf + if ($originalSetting) { $status = $statusMap['NotAFinding'] @@ -330,6 +336,7 @@ function New-StigCheckList elseif ($PSCmdlet.ParameterSetName -eq 'result') { $originalSetting = Get-SettingsFromResult -DscResult $dscResult -id $convertedRule.DuplicateOf + if ($originalSetting.InDesiredState -eq 'True') { $status = $statusMap['NotAFinding'] @@ -558,6 +565,12 @@ function Get-FindingDetails } } } + +<# + .SYNOPSIS + Formats properties and values with standard string format. + +#> function Get-FindingDetailsString { [OutputType([string])] @@ -615,7 +628,7 @@ function Get-TargetNodeType { return 'MACAddress' } - + # Do we have an IPv6 address? { $_ -match '(([0-9a-f]{0,4}:){7}[0-9a-f]{0,4})' @@ -623,7 +636,7 @@ function Get-TargetNodeType { return 'IPv4Address' } - + # Do we have an IPv4 address? { $_ -match '(([0-9]{1,3}\.){3}[0-9]{1,3})' @@ -631,7 +644,7 @@ function Get-TargetNodeType { return 'IPv6Address' } - + # Do we have a Fully-qualified Domain Name? { $_ -match '([a-zA-Z0-9-.\+]{2,256}\.[a-z]{2,256}\b)' @@ -640,5 +653,6 @@ function Get-TargetNodeType return 'FQDN' } } + return '' } From 5e1a9dd28f2b46e9d5d4b73ffd17b2e43efd2a64 Mon Sep 17 00:00:00 2001 From: Steve Hose <33662177+stevehose@users.noreply.github.com> Date: Wed, 8 Jan 2020 17:09:23 -0500 Subject: [PATCH 39/42] Updated for PR --- Module/Common/Functions.XccdfXml.ps1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Module/Common/Functions.XccdfXml.ps1 b/Module/Common/Functions.XccdfXml.ps1 index ec8d4ba0e..1e6416c6d 100644 --- a/Module/Common/Functions.XccdfXml.ps1 +++ b/Module/Common/Functions.XccdfXml.ps1 @@ -164,7 +164,7 @@ function Get-StigRuleList [int] $stigGroupCount = @($StigGroupList).Count [int] $stigProcessedCounter = 1 - # Global added so that the stig rule can be referenced later + # Global added so that the stig rule can be referenced later. if (-not $exclusionRuleList) { $exclusionFile = Resolve-Path -Path $PSScriptRoot\..\Common\Data.ps1 From 6c54b4bdd21f5ddcb8d3982bc93440c7dc418d56 Mon Sep 17 00:00:00 2001 From: Steve Hose <33662177+stevehose@users.noreply.github.com> Date: Thu, 9 Jan 2020 12:01:22 -0500 Subject: [PATCH 40/42] Updates for PR --- Module/Common/Functions.XccdfXml.ps1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Module/Common/Functions.XccdfXml.ps1 b/Module/Common/Functions.XccdfXml.ps1 index 1e6416c6d..cab9fe289 100644 --- a/Module/Common/Functions.XccdfXml.ps1 +++ b/Module/Common/Functions.XccdfXml.ps1 @@ -502,7 +502,7 @@ function Get-StigVersionNumber -split "(Release:)(.*?)(Benchmark)" )[2].trim() "$($StigDetails.Benchmark.version).$revision" - + } #endregion From 0a55de9befdbce3b4adec9e8baac19d9f739206a Mon Sep 17 00:00:00 2001 From: Steve Hose <33662177+stevehose@users.noreply.github.com> Date: Thu, 9 Jan 2020 12:17:51 -0500 Subject: [PATCH 41/42] Moving changes for SQL to another branch --- .../U_MS_SQL_Server_2016_Instance_STIG_V1R3_Manual-xccdf.log | 1 - .../U_MS_SQL_Server_2016_Instance_STIG_V1R7_Manual-xccdf.log | 1 - 2 files changed, 2 deletions(-) diff --git a/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R3_Manual-xccdf.log b/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R3_Manual-xccdf.log index 2a21cb556..26bc4e879 100644 --- a/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R3_Manual-xccdf.log +++ b/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R3_Manual-xccdf.log @@ -1,3 +1,2 @@ -V-79141::*::'' V-79197::If "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding. ::If the value for "System_cryptography_Use_FIPS_compliant_algorithms_for_encryption_hashing_and_signing" is not "enabled", this is a finding. V-79213::Local Security Policy >> Local Policies >> Security Options::"" diff --git a/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R7_Manual-xccdf.log b/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R7_Manual-xccdf.log index ec7530da0..4f8c262b2 100644 --- a/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R7_Manual-xccdf.log +++ b/StigData/Archive/SQL Server/U_MS_SQL_Server_2016_Instance_STIG_V1R7_Manual-xccdf.log @@ -1,4 +1,3 @@ -V-79141::*::'' V-79197::If "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" is not enabled, this is a finding.::If the value for "System_cryptography_Use_FIPS_compliant_algorithms_for_encryption_hashing_and_signing" is not "enabled", this is a finding. V-79213::Local Security Policy >> Local Policies >> Security Options::"" V-97521::*::HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 3.0\Client'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 3.0\Server'; ValueData = 1; ValueName = 'DisabledByDefault'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 3.0\Client'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'Dword'}HardCodedRule(RegistryRule)@{DscResource = 'Registry'; Ensure = 'Present'; Key = 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 3.0\Server'; ValueData = 0; ValueName = 'Enabled'; ValueType = 'Dword'} From 5f3bd7c289d42dadec47a002158a018b700aa780 Mon Sep 17 00:00:00 2001 From: Steve Hose <33662177+stevehose@users.noreply.github.com> Date: Mon, 13 Jan 2020 15:57:58 -0500 Subject: [PATCH 42/42] Update for PR --- Module/STIG/Functions.Checklist.ps1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Module/STIG/Functions.Checklist.ps1 b/Module/STIG/Functions.Checklist.ps1 index b6d62dd2b..e9814a74e 100644 --- a/Module/STIG/Functions.Checklist.ps1 +++ b/Module/STIG/Functions.Checklist.ps1 @@ -64,7 +64,7 @@ function New-StigCheckList { throw "$($ManualCheckFile) is not a valid path to a ManualCheckFile. Provide a full valid path" } - $manualCheckData = Invoke-Expression (Get-Content $manualCheckFile | Out-String) + [string]$manualCheckData = Get-Content $manualCheckFile } if (-not (Test-Path -Path $OutputPath.DirectoryName))