Ensure 'Configure RPC over TCP port' is set to 'Enabled: 0'

HighLevel 1Automatedwindows

Description

This policy setting controls which port is used for RPC over TCP for incoming connections to the print spooler and outgoing connections to remote print spoolers. The recommended state for this setting is: Enabled: 0.

How it is checked

Audit method: Windows registry

registry

$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\RPC' -Name 'RpcTcpPort' -ErrorAction SilentlyContinue).'RpcTcpPort'; if (-not ($null -ne $v -and @(0) -contains [int64]$v)) { $bad += 'RpcTcpPort=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

Expected output: compliant

How it is fixed

Fix method: Shell command

shell

if (-not (Test-Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\RPC')) { New-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\RPC' -Force | Out-Null }; New-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\RPC' -Name 'RpcTcpPort' -Value 0 -PropertyType DWord -Force | Out-Null

Properties

Operating systems: windows-10
Tags: cis-convertedregistrywindows
Reference: CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 - 18.7.7

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target windows