TMA-PALOALTO-2.5
Ensure that the User-ID Agent has minimal permissions if User-ID is enabled
Açıklama
If the integrated (on-device) User-ID Agent is utilized, the Active Directory account for the agent should only be a member of the Event Log Readers group, Distributed COM Users group, and Domain Users group. If the Windows User-ID agent is utilized, the Active Directory account for the agent should only be a member of the Event Log Readers group, Server Operators group, and Domain Users group.
Nasıl denetlenir
Denetim yöntemi: Manuel inceleme
Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.
Navigate to Active Directory Users and Computers for the Active Directory under consideration. Verify that the service account for the User-ID agent is not a member of any groups other than Event Log Readers, Distributed COM Users, and Domain Users (for the integrated, on-device User-ID agent) or Event Log Readers, Server Operators, and Domain Users (for the Windows User-ID agent.)
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Navigate to Active Directory Users and Computers. Set the service account for the User-ID agent so that it is only a member of the Event Log Readers, Distributed COM Users, and Domain Users (for the integrated, on-device User-ID agent) or the Event Log Readers, Server Operators, and Domain Users groups (for the Windows User-ID agent.)
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- paloaltoauthentication
- Referans
- CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 2.5 Ensure that the User-ID Agent has minimal permissions if User-ID is enabled