TMA-WIN10-2.2.33

Ensure 'Perform volume maintenance tasks' is set to 'Administrators'

高レベル 1自動windows

説明

This policy setting allows users to manage the system's volume or disk configuration, which could allow a user to delete a volume and cause data loss as well as a denial-of- service condition. The recommended state for this setting is: Administrators. Note: A workstation with Microsoft SQL Server installed will require a special exception to this recommendation for the account that runs the SQL Server service to be granted this user right.

チェック方法

監査方法: シェルコマンド

shell

$f = Join-Path $env:TEMP ('tmaegis-' + [guid]::NewGuid().ToString() + '.inf'); secedit /export /cfg $f /areas SECURITYPOLICY USER_RIGHTS /quiet | Out-Null; $c = Get-Content $f -ErrorAction SilentlyContinue; Remove-Item $f -Force -ErrorAction SilentlyContinue; $line = $c | Where-Object { $_ -match '^\s*SeManageVolumePrivilege\s*=' } | Select-Object -First 1; $v = if ($line) { ($line -split '=', 2)[1].Trim().Trim('"') } else { $null }; $have = @(if ($v) { $v -split ',' | ForEach-Object { $_.Trim().TrimStart('*') } | Where-Object { $_ } }); if ((($have | Sort-Object -Unique) -join ',') -eq 'S-1-5-32-544') { 'compliant' } else { 'non-compliant: ' + ($have -join ',') }

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Set through Group Policy (domain policy for domain members): Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Perform volume maintenance tasks

プロパティ

オペレーティングシステム: windows-10
タグ: cis-convertedseceditwindows
参照: CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 - 2.2.33

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target windows