Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-3470 | 3.082 | SV-25169r1_rule | ECSC-1 | Medium |
Description |
---|
This setting controls whether unsolicited offers of help to this computer are allowed. This has the possibility of allowing unauthorized users access to a system. |
STIG | Date |
---|---|
Windows 7 Security Technical Implementation Guide | 2012-07-02 |
Check Text ( C-32863r1_chk ) |
---|
If the following registry value doesn’t exist or is not configured as specified this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fAllowUnsolicited Type: REG_DWORD Value: 0 Documentable: Yes Documentable Explanation: Offer remote assistance can be enabled on workstations if mitigations are in place. This must be documented with the IAO. Mitigations: -Users must be trained to include the following: -Who they can accept assistance offer from. Offer must be in response to help desk request or confirmed with help desk if unsolicited offer comes through. -Users must know how to accept request, allow view or control, and how to disconnect a remote assistance session. -Users needs monitor the assistance activity at the workstation while it is occurring. -The support personnel allowed to offer assistance (helpers) must be limited and documented. -Port 3389 should be blocked at the perimeter to prevent other access. Accounts and groups authorized to offer remote assistance (helpers) are identified in the following registry key. Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ RAUnsolicit\ Each Account or group will be listed under a separate value name with the value equaling the value name as in the following examples. Value Name: Administrators Type: REG_SZ Value: Administrators Value Name: TestUser Type: REG_SZ Value: TestUser |
Fix Text (F-6776r1_fix) |
---|
Configure the system to prevent unsolicited remote assistance offers by setting the policy value for Computer Configuration -> Administrative Templates -> System -> Remote Assistance “Offer Remote Assistance” to “Disabled”. |