Ensure 'Allow remote server management through WinRM' is set to 'Disabled'

OrtaDüzey 2Otomatikwindows

Açıklama

This policy setting allows you to manage whether the Windows Remote Management (WinRM) service automatically listens on the network for requests on the HTTP transport over the default HTTP port. The recommended state for this setting is: Disabled.

Nasıl denetlenir

Denetim yöntemi: Windows kayıt defteri

registry

$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service' -Name 'AllowAutoConfig' -ErrorAction SilentlyContinue).'AllowAutoConfig'; if (-not ($null -ne $v -and @(0) -contains [int64]$v)) { $bad += 'AllowAutoConfig=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kabuk komutu

shell

if (-not (Test-Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service')) { New-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service' -Force | Out-Null }; New-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service' -Name 'AllowAutoConfig' -Value 0 -PropertyType DWord -Force | Out-Null

Özellikler

İşletim sistemleri: windows-server-2022-dc, windows-server-2022-ms
Etiketler: cis-convertedregistrywindows
Referans: CIS Microsoft Windows Server 2022 Benchmark v5.1.0 - 18.10.90.2.2

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target windows --level 2