Ensure 'Allow log on through Remote Desktop Services' is set to 'Administrators, Remote Desktop Users'

ВысокийУровень 1Автоматическаяwindows

Описание

This policy setting determines which users or groups have the right to log on as a Remote Desktop Services client. If your organization uses Remote Assistance as part of its help desk strategy, create a group and assign it this user right through Group Policy. If the help desk in your organization does not use Remote Assistance, assign this user right only to the Administrators group or use the Restricted Groups feature to ensure that no user accounts are part of the Remote Desktop Users group. Restrict this user right to the Administrators group, and possibly the Remote Desktop Users group, t

Как проверяется

Метод проверки: Команда оболочки

shell

$f = Join-Path $env:TEMP ('tmaegis-' + [guid]::NewGuid().ToString() + '.inf'); secedit /export /cfg $f /areas SECURITYPOLICY USER_RIGHTS /quiet | Out-Null; $c = Get-Content $f -ErrorAction SilentlyContinue; Remove-Item $f -Force -ErrorAction SilentlyContinue; $line = $c | Where-Object { $_ -match '^\s*SeRemoteInteractiveLogonRight\s*=' } | Select-Object -First 1; $v = if ($line) { ($line -split '=', 2)[1].Trim().Trim('"') } else { $null }; $have = @(if ($v) { $v -split ',' | ForEach-Object { $_.Trim().TrimStart('*') } | Where-Object { $_ } }); if ((($have | Sort-Object -Unique) -join ',') -eq 'S-1-5-32-544,S-1-5-32-555') { 'compliant' } else { 'non-compliant: ' + ($have -join ',') }

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Set through Group Policy (domain policy for domain members): Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on through Remote Desktop Services

Свойства

Операционные системы: windows-10
Теги: cis-convertedseceditwindows
Источник: CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 - 2.2.6

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target windows