The Recycle Bin on a Server is not configured to delete files.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-1126	3.051	SV-16948r1_rule	ECSC-1	Low

Description
The Recycle Bin saves a copy of a file when it is deleted through Windows Explorer. This poses a security risk. A user may delete a sensitive file, yet still leave a copy of that file in the Recycle Bin.

STIG	Date
Windows 2008 Domain Controller Security Technical Implementation Guide	2013-07-03

Details

Check Text ( C-27271r1_chk )
If the following registry value doesn’t exist or is not configured as specified this is a finding: Registry Hive: HKEY_CURRENT_USER Subkey: \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Value Name: NoRecycleFiles Type: REG_DWORD Value: 1 If this is configured in the Recycle Bin Properties instead of through a policy verify the following: Right Click the Recycle Bin and select Properties Select each Recycle Bin Location Verify that “Do not move files to the Recycle Bin. Remove files immediately when deleted.” is selected. If any of the drives are not configured to delete files immediately, then this is a finding. Note: The Gold Disk will only check for the registry value updated by the policy in the Fix section. If it is configured using the Recycle Bin Properties, it must be verified manually.

Check Text ( C-27271r1_chk )

If the following registry value doesn’t exist or is not configured as specified this is a finding:

Registry Hive: HKEY_CURRENT_USER
Subkey: \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Value Name: NoRecycleFiles
Type: REG_DWORD
Value: 1

If this is configured in the Recycle Bin Properties instead of through a policy verify the following:

Right Click the Recycle Bin and select Properties
Select each Recycle Bin Location
Verify that “Do not move files to the Recycle Bin. Remove files immediately when deleted.” is selected.

If any of the drives are not configured to delete files immediately, then this is a finding.

Note: The Gold Disk will only check for the registry value updated by the policy in the Fix section. If it is configured using the Recycle Bin Properties, it must be verified manually.

Fix Text (F-23313r1_fix)
Configure the policy value for User Configuration -> Administrative Templates -> Windows Components -> Windows Explorer “Do not move deleted files to the Recycle Bin” to “Enabled”. Or Select “Do not move files to the Recycle Bin. Remove files immediately when deleted.” for each volume in the Recycle Bin Properties.