Ensure 'Log on as a batch job' is set to 'Administrators' (DC Only)

MediaNivel 2Automatizadawindows

Descripción

This policy setting allows accounts to log on using the task scheduler service. Because the task scheduler is often used for administrative purposes, it may be needed in enterprise environments. However, its use should be restricted in high security environments to prevent misuse of system resources or to prevent threat actors from using the right to launch malicious code after gaining user level access to a computer. The recommended state for this setting is: Administrators. Note: Certain policy settings must be configured in the Default Domain Controller Policy to ensure they are applied glo

Cómo se verifica

Método de auditoría: Comando de shell

shell

$f = Join-Path $env:TEMP ('tmaegis-' + [guid]::NewGuid().ToString() + '.inf'); secedit /export /cfg $f /areas SECURITYPOLICY USER_RIGHTS /quiet | Out-Null; $c = Get-Content $f -ErrorAction SilentlyContinue; Remove-Item $f -Force -ErrorAction SilentlyContinue; $line = $c | Where-Object { $_ -match '^\s*SeBatchLogonRight\s*=' } | Select-Object -First 1; $v = if ($line) { ($line -split '=', 2)[1].Trim().Trim('"') } else { $null }; $have = @(if ($v) { $v -split ',' | ForEach-Object { $_.Trim().TrimStart('*') } | Where-Object { $_ } }); if ((($have | Sort-Object -Unique) -join ',') -eq 'S-1-5-32-544') { 'compliant' } else { 'non-compliant: ' + ($have -join ',') }

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set through Group Policy (domain policy for domain members): Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Log on as a batch job

Propiedades

Sistemas operativos: windows-server-2025-dc
Etiquetas: cis-convertedseceditwindows
Referencia: CIS Microsoft Windows Server 2025 Benchmark v2.1.0 - 2.2.36

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target windows --level 2