Ensure 'Allow remote server management through WinRM' is set to 'Disabled'

SrednjaNivo 2Automatskawindows

Opis

This policy setting allows you to manage whether the Windows Remote Management (WinRM) service automatically listens on the network for requests on the HTTP transport over the default HTTP port. The recommended state for this setting is: Disabled.

Kako se proverava

Metod provere: Windows registar

registry

$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service' -Name 'AllowAutoConfig' -ErrorAction SilentlyContinue).'AllowAutoConfig'; if (-not ($null -ne $v -and @(0) -contains [int64]$v)) { $bad += 'AllowAutoConfig=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Komanda ljuske

shell

if (-not (Test-Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service')) { New-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service' -Force | Out-Null }; New-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service' -Name 'AllowAutoConfig' -Value 0 -PropertyType DWord -Force | Out-Null

Svojstva

Operativni sistemi: windows-server-2022-dc, windows-server-2022-ms
Oznake: cis-convertedregistrywindows
Referenca: CIS Microsoft Windows Server 2022 Benchmark v5.1.0 - 18.10.90.2.2

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target windows --level 2