Ensure 'Deny access to this computer from the network' to include 'Guests, Local account'

CaoCấp 1Tự độngwindows

Mô tả

This policy setting prohibits users from connecting to a computer from across the network, which would allow users to access and potentially modify data remotely. In high security environments, there should be no need for remote users to access data on a computer. Instead, file sharing should be accomplished through the use of network servers. This user right supersedes the Access this computer from the network user right if an account is subject to both policies. The recommended state for this setting is to include: Guests, Local account. Caution: Configuring a standalone (non-domain-joined)

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

$f = Join-Path $env:TEMP ('tmaegis-' + [guid]::NewGuid().ToString() + '.inf'); secedit /export /cfg $f /areas SECURITYPOLICY USER_RIGHTS /quiet | Out-Null; $c = Get-Content $f -ErrorAction SilentlyContinue; Remove-Item $f -Force -ErrorAction SilentlyContinue; $line = $c | Where-Object { $_ -match '^\s*SeDenyNetworkLogonRight\s*=' } | Select-Object -First 1; $v = if ($line) { ($line -split '=', 2)[1].Trim().Trim('"') } else { $null }; $have = @(if ($v) { $v -split ',' | ForEach-Object { $_.Trim().TrimStart('*') } | Where-Object { $_ } }); $missing = @('S-1-5-32-546','S-1-5-113') | Where-Object { $have -notcontains $_ }; if ($missing.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($have -join ',') }

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Set through Group Policy (domain policy for domain members): Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny access to this computer from the network

Thuộc tính

Hệ điều hành: windows-10
Thẻ: cis-convertedseceditwindows
Tham chiếu: CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 - 2.2.16

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target windows