Users must be prevented from redirecting Plug and Play devices to the Remote Desktop Session Host. (Remote Desktop Services Role).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-225407	WN12-CC-000135	SV-225407r569185_rule		Medium

Description
Preventing the redirection of Plug and Play devices in Remote Desktop sessions helps reduce possible exposure of sensitive data.

STIG	Date
Microsoft Windows Server 2012/2012 R2 Member Server Security Technical Implementation Guide	2022-03-01

Details

Check Text ( C-27106r471563_chk )
If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fDisablePNPRedir Type: REG_DWORD Value: 1

Fix Text (F-27094r471564_fix)
Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Device and Resource Redirection -> "Do not allow supported Plug and Play device redirection" to "Enabled".