The system must be configured to collect unplanned Windows server shutdown events.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-56569	WINER-000111	SV-70829r1_rule	ECSC-1	Medium

Description
Windows Error Reporting information can be used to help diagnose day-to-day software issues, as well as help discover malicious code and possibly zero-day attacks on systems. This setting includes unplanned shutdown events in error reporting.

STIG	Date
Windows 2003 Member Server Security Technical Implementation Guide	2015-06-24

Details

Check Text ( None )
None

Fix Text (F-61457r1_fix)
Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Error Reporting -> Advanced Error Reporting settings -> "Report unplanned shutdown events" to "Enabled".