Ensure 'Network access: Do not allow storage of passwords and credentials for network authentication' is set to 'Enabled'

OrtaDüzey 2Otomatikwindows

Açıklama

This policy setting determines whether Credential Manager (formerly called Stored User Names and Passwords) saves passwords or credentials for later use when it gains domain authentication. The recommended state for this setting is: Enabled. Note: Changes to this setting will not take effect until Windows is restarted.

Nasıl denetlenir

Denetim yöntemi: Windows kayıt defteri

registry

$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa' -Name 'DisableDomainCreds' -ErrorAction SilentlyContinue).'DisableDomainCreds'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'DisableDomainCreds=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kabuk komutu

shell

if (-not (Test-Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa')) { New-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa' -Force | Out-Null }; New-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa' -Name 'DisableDomainCreds' -Value 1 -PropertyType DWord -Force | Out-Null

Özellikler

İşletim sistemleri: windows-server-2025-dc, windows-server-2025-ms
Etiketler: cis-convertedregistrywindows
Referans: CIS Microsoft Windows Server 2025 Benchmark v2.1.0 - 2.3.10.4

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target windows --level 2