TMA-WIN10-2.2.6
Ensure 'Allow log on through Remote Desktop Services' is set to 'Administrators, Remote Desktop Users'
Description
This policy setting determines which users or groups have the right to log on as a Remote Desktop Services client. If your organization uses Remote Assistance as part of its help desk strategy, create a group and assign it this user right through Group Policy. If the help desk in your organization does not use Remote Assistance, assign this user right only to the Administrators group or use the Restricted Groups feature to ensure that no user accounts are part of the Remote Desktop Users group. Restrict this user right to the Administrators group, and possibly the Remote Desktop Users group, t
How it is checked
Audit method: Shell command
$f = Join-Path $env:TEMP ('tmaegis-' + [guid]::NewGuid().ToString() + '.inf'); secedit /export /cfg $f /areas SECURITYPOLICY USER_RIGHTS /quiet | Out-Null; $c = Get-Content $f -ErrorAction SilentlyContinue; Remove-Item $f -Force -ErrorAction SilentlyContinue; $line = $c | Where-Object { $_ -match '^\s*SeRemoteInteractiveLogonRight\s*=' } | Select-Object -First 1; $v = if ($line) { ($line -split '=', 2)[1].Trim().Trim('"') } else { $null }; $have = @(if ($v) { $v -split ',' | ForEach-Object { $_.Trim().TrimStart('*') } | Where-Object { $_ } }); if ((($have | Sort-Object -Unique) -join ',') -eq 'S-1-5-32-544,S-1-5-32-555') { 'compliant' } else { 'non-compliant: ' + ($have -join ',') }- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Set through Group Policy (domain policy for domain members): Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on through Remote Desktop Services
Properties
- Operating systems
- windows-10
- Tags
- cis-convertedseceditwindows
- Reference
- CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 - 2.2.6
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target windows