Ensure 'Remote host allows delegation of non- exportable credentials' is set to 'Enabled'

YüksekDüzey 1Otomatikwindows

Açıklama

Remote host allows delegation of non-exportable credentials. When using credential delegation, devices provide an exportable version of credentials to the remote host. This exposes users to the risk of credential theft from attackers on the remote host. The Restricted Admin Mode and Windows Defender Remote Credential Guard features are two options to help protect against this risk. The recommended state for this setting is: Enabled. Note: More detailed information on Windows Defender Remote Credential Guard and how it compares to Restricted Admin Mode can be found at this link: Protect Remote

Nasıl denetlenir

Denetim yöntemi: Windows kayıt defteri

registry

$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation' -Name 'AllowProtectedCreds' -ErrorAction SilentlyContinue).'AllowProtectedCreds'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'AllowProtectedCreds=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kabuk komutu

shell

if (-not (Test-Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation')) { New-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation' -Force | Out-Null }; New-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation' -Name 'AllowProtectedCreds' -Value 1 -PropertyType DWord -Force | Out-Null

Özellikler

İşletim sistemleri: windows-10
Etiketler: cis-convertedregistrywindows
Referans: CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 - 18.9.4.2

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target windows