Ensure 'Deny log on as a service' to include 'Guests'

ВисокаНиво 1Аутоматскаwindows

Опис

This security setting determines which service accounts are prevented from registering a process as a service. This user right supersedes the Log on as a service user right if an account is subject to both policies. The recommended state for this setting is to include: Guests. Note: This security setting does not apply to the System, Local Service, or Network Service accounts.

Како се проверава

Метод провере: Команда љуске

shell

$f = Join-Path $env:TEMP ('tmaegis-' + [guid]::NewGuid().ToString() + '.inf'); secedit /export /cfg $f /areas SECURITYPOLICY USER_RIGHTS /quiet | Out-Null; $c = Get-Content $f -ErrorAction SilentlyContinue; Remove-Item $f -Force -ErrorAction SilentlyContinue; $line = $c | Where-Object { $_ -match '^\s*SeDenyServiceLogonRight\s*=' } | Select-Object -First 1; $v = if ($line) { ($line -split '=', 2)[1].Trim().Trim('"') } else { $null }; $have = @(if ($v) { $v -split ',' | ForEach-Object { $_.Trim().TrimStart('*') } | Where-Object { $_ } }); $missing = @('S-1-5-32-546') | Where-Object { $have -notcontains $_ }; if ($missing.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($have -join ',') }

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Set through Group Policy (domain policy for domain members): Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny log on as a service

Својства

Оперативни системи: windows-10
Ознаке: cis-convertedseceditwindows
Референца: CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 - 2.2.18

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target windows