TMA-EDGE-1.14.1
Ensure 'Allow Basic authentication for HTTP' is set to 'Disabled'
Açıklama
This policy setting determines if Basic authentication receives challenges over non- secure HTTP. Basic authentication is a non-secure authentication method that relies on sending the username and password to the server in plaintext. The recommended state for this setting is: Disabled. Rationale: Basic authentication is less robust than other authentication methods available because credentials including passwords are transmitted in plain text. An attacker who can capture these credentials in plain text can gain access to the system. Audit reads the Group Policy registry value and prints 'compliant', 'unset' (policy not configured, reported as FAIL) or the non-compliant value. Registry value: HKLM\SOFTWARE\Policies\Microsoft\Edge:BasicAuthOverHttpEnabled (REG_DWORD); compliant when it is 0. Remediation writes 0 locally; in a domain set it through the ADMX so Group Policy does not revert it.
Nasıl denetlenir
Denetim yöntemi: Windows kayıt defteri
$v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge' -Name 'BasicAuthOverHttpEnabled' -ErrorAction SilentlyContinue).'BasicAuthOverHttpEnabled'; if ($null -eq $v) { 'unset' } elseif (($null -ne $v -and @(0) -contains [int64]$v)) { 'compliant' } else { "non-compliant: $v" }- Beklenen çıktı
compliant
Nasıl düzeltilir
Düzeltme yöntemi: Kabuk komutu
$p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'BasicAuthOverHttpEnabled' -Value 0 -PropertyType DWord -Force | Out-NullÖzellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- edgebrowsercis-l1
- Referans
- CIS Microsoft Edge Benchmark v5.0.0 - 1.14.1 Ensure 'Allow Basic authentication for HTTP' is set to 'Disabled'
Bu ana makineyi denetle
Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.
tmaegis scan --target edge