Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32282	WINRG-000001	SV-42617r1_rule	ECCD-1 ECCD-2	High

Description
Permissions on the Active Setup\Installed Components registry key must only allow privileged accounts to add or change registry values. If standard user accounts have this capability there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.

STIG	Date
Windows 2008 Domain Controller Security Technical Implementation Guide	2013-07-03

Details

Check Text ( C-40783r2_chk )
Navigate to the following registry key and review the assigned permissions: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components On 64-bit systems also review the permissions assigned to the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components Verify that standard user accounts and groups only have Read permissions to this registry key. If any standard user accounts or groups have greater permissions this is a finding. The default permissions satisfy this requirement.

Check Text ( C-40783r2_chk )

Navigate to the following registry key and review the assigned permissions:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components

On 64-bit systems also review the permissions assigned to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components

Verify that standard user accounts and groups only have Read permissions to this registry key. If any standard user accounts or groups have greater permissions this is a finding. The default permissions satisfy this requirement.

Fix Text (F-36207r3_fix)
Ensure only Read permissions are assigned to standard user accounts and groups for the following registry keys. The default configuration satisfies this requirement. All systems HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components 64-bit systems HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components