Windows (desktop and server)
TMA-WIN2025-18.9.38.2
Ensure 'Restrict Unauthenticated RPC clients' is set to 'Enabled: Authenticated' (MS only)
Beschreibung
This policy setting controls how the RPC server runtime handles unauthenticated RPC clients connecting to RPC servers. This policy setting impacts all RPC applications. In a domain environment this policy setting should be used with caution as it can impact a wide range of functionality including group policy processing itself. Reverting a change to this policy setting can require manual intervention on each affected machine. This policy setting should never be applied to a Domain Controller. A client will be considered an authenticated client if it uses a named pipe to communicate with the se
So wird geprüft
Prüfmethode: Windows-Registrierung
$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Rpc' -Name 'RestrictRemoteClients' -ErrorAction SilentlyContinue).'RestrictRemoteClients'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'RestrictRemoteClients=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Shell-Befehl
if (-not (Test-Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Rpc')) { New-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Rpc' -Force | Out-Null }; New-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Rpc' -Name 'RestrictRemoteClients' -Value 1 -PropertyType DWord -Force | Out-NullEigenschaften
- Betriebssysteme
- windows-server-2025-ms
- Tags
- cis-convertedregistrywindows
- Referenz
- CIS Microsoft Windows Server 2025 Benchmark v2.1.0 - 18.9.38.2
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target windows --level 2