TMA-PALOALTO-2.5
Ensure that the User-ID Agent has minimal permissions if User-ID is enabled
Deskripsi
If the integrated (on-device) User-ID Agent is utilized, the Active Directory account for the agent should only be a member of the Event Log Readers group, Distributed COM Users group, and Domain Users group. If the Windows User-ID agent is utilized, the Active Directory account for the agent should only be a member of the Event Log Readers group, Server Operators group, and Domain Users group.
Cara pemeriksaan
Metode audit: Tinjauan manual
Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.
Navigate to Active Directory Users and Computers for the Active Directory under consideration. Verify that the service account for the User-ID agent is not a member of any groups other than Event Log Readers, Distributed COM Users, and Domain Users (for the integrated, on-device User-ID agent) or Event Log Readers, Server Operators, and Domain Users (for the Windows User-ID agent.)
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Navigate to Active Directory Users and Computers. Set the service account for the User-ID agent so that it is only a member of the Event Log Readers, Distributed COM Users, and Domain Users (for the integrated, on-device User-ID agent) or the Event Log Readers, Server Operators, and Domain Users groups (for the Windows User-ID agent.)
Properti
- Sistem operasi
- Apa saja
- Tag
- paloaltoauthentication
- Referensi
- CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 2.5 Ensure that the User-ID Agent has minimal permissions if User-ID is enabled