Windows (desktop and server)
TMA-WIN10-2.2.37
Ensure 'Restore files and directories' is set to 'Administrators'
Description
This policy setting determines which users can bypass file, directory, registry, and other persistent object permissions when restoring backed up files and directories on computers that run Windows Vista (or newer) in your environment. This user right also determines which users can set valid security principals as object owners; it is similar to the Back up files and directories user right. The recommended state for this setting is: Administrators. Note: This user right is considered a "sensitive privilege" for the purposes of auditing.
How it is checked
Audit method: Shell command
$f = Join-Path $env:TEMP ('tmaegis-' + [guid]::NewGuid().ToString() + '.inf'); secedit /export /cfg $f /areas SECURITYPOLICY USER_RIGHTS /quiet | Out-Null; $c = Get-Content $f -ErrorAction SilentlyContinue; Remove-Item $f -Force -ErrorAction SilentlyContinue; $line = $c | Where-Object { $_ -match '^\s*SeRestorePrivilege\s*=' } | Select-Object -First 1; $v = if ($line) { ($line -split '=', 2)[1].Trim().Trim('"') } else { $null }; $have = @(if ($v) { $v -split ',' | ForEach-Object { $_.Trim().TrimStart('*') } | Where-Object { $_ } }); if ((($have | Sort-Object -Unique) -join ',') -eq 'S-1-5-32-544') { 'compliant' } else { 'non-compliant: ' + ($have -join ',') }- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Set through Group Policy (domain policy for domain members): Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Restore files and directories
Properties
- Operating systems
- windows-10
- Tags
- cis-convertedseceditwindows
- Reference
- CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 - 2.2.37
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target windows