Ensure 'Remote host allows delegation of non- exportable credentials' is set to 'Enabled'

HochStufe 1Automatisiertwindows

Beschreibung

Remote host allows delegation of non-exportable credentials. When using credential delegation, devices provide an exportable version of credentials to the remote host. This exposes users to the risk of credential theft from attackers on the remote host. The Restricted Admin Mode and Windows Defender Remote Credential Guard features are two options to help protect against this risk. The recommended state for this setting is: Enabled. Note: More detailed information on Windows Defender Remote Credential Guard and how it compares to Restricted Admin Mode can be found at this link: Protect Remote

So wird geprüft

Prüfmethode: Windows-Registrierung

registry

$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation' -Name 'AllowProtectedCreds' -ErrorAction SilentlyContinue).'AllowProtectedCreds'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'AllowProtectedCreds=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Shell-Befehl

shell

if (-not (Test-Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation')) { New-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation' -Force | Out-Null }; New-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation' -Name 'AllowProtectedCreds' -Value 1 -PropertyType DWord -Force | Out-Null

Eigenschaften

Betriebssysteme: windows-10
Tags: cis-convertedregistrywindows
Referenz: CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 - 18.9.4.2

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target windows