UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The Deny log on locally user right on domain controllers must be configured to prevent unauthenticated access.


Overview

Finding ID Version Rule ID IA Controls Severity
V-26485 WINUR-000020-DC SV-47105r1_rule ECLP-1 Medium
Description
Inappropriate granting of user rights can provide system, administrative, and other high level capabilities. The "Deny log on locally" right defines accounts that are prevented from logging on interactively. The Guests group and Support_388945a0 account must be assigned this right to prevent unauthenticated access.
STIG Date
Windows 2003 Domain Controller Security Technical Implementation Guide 2014-04-07

Details

Check Text ( None )
None
Fix Text (F-41018r2_fix)
Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Deny log on locally" to include the following.

Guests Group
Support_388945a0