Ensure 'Encryption Oracle Remediation' is set to 'Enabled: Force Updated Clients'

YüksekDüzey 1Otomatikwindows

Açıklama

Some versions of the CredSSP protocol that is used by some applications (such as Remote Desktop Connection) are vulnerable to an encryption oracle attack against the client. This policy controls compatibility with vulnerable clients and servers and allows you to set the level of protection desired for the encryption oracle vulnerability. The recommended state for this setting is: Enabled: Force Updated Clients.

Nasıl denetlenir

Denetim yöntemi: Windows kayıt defteri

registry

$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters' -Name 'AllowEncryptionOracle' -ErrorAction SilentlyContinue).'AllowEncryptionOracle'; if (-not ($null -ne $v -and @(0) -contains [int64]$v)) { $bad += 'AllowEncryptionOracle=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kabuk komutu

shell

if (-not (Test-Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters')) { New-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters' -Force | Out-Null }; New-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters' -Name 'AllowEncryptionOracle' -Value 0 -PropertyType DWord -Force | Out-Null

Özellikler

İşletim sistemleri: windows-10
Etiketler: cis-convertedregistrywindows
Referans: CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 - 18.9.4.1

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target windows