Ensure 'Allow log on locally' is set to 'Administrators, Users'

AltaNível 1Automatizadawindows

Descrição

This policy setting determines which users can interactively log on to computers in your environment. Logons that are initiated by pressing the CTRL+ALT+DEL key sequence on the client computer keyboard require this user right. Users who attempt to log on through Terminal Services / Remote Desktop Services or IIS also require this user right. The recommended state for this setting is: Administrators, Users. Note: The Guest account is also assigned this user right by default. Although this account is disabled by default, it's recommended that you configure this setting through Group Policy. Howe

Como é verificado

Método de auditoria: Comando shell

shell

$f = Join-Path $env:TEMP ('tmaegis-' + [guid]::NewGuid().ToString() + '.inf'); secedit /export /cfg $f /areas SECURITYPOLICY USER_RIGHTS /quiet | Out-Null; $c = Get-Content $f -ErrorAction SilentlyContinue; Remove-Item $f -Force -ErrorAction SilentlyContinue; $line = $c | Where-Object { $_ -match '^\s*SeInteractiveLogonRight\s*=' } | Select-Object -First 1; $v = if ($line) { ($line -split '=', 2)[1].Trim().Trim('"') } else { $null }; $have = @(if ($v) { $v -split ',' | ForEach-Object { $_.Trim().TrimStart('*') } | Where-Object { $_ } }); if ((($have | Sort-Object -Unique) -join ',') -eq 'S-1-5-32-544,S-1-5-32-545') { 'compliant' } else { 'non-compliant: ' + ($have -join ',') }

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Set through Group Policy (domain policy for domain members): Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on locally

Propriedades

Sistemas operacionais: windows-10
Tags: cis-convertedseceditwindows
Referência: CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 - 2.2.5

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target windows