The system is configured to allow unsolicited remote assistance offers.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3470	3.082	SV-25169r1_rule	ECSC-1	Medium

Description
This setting controls whether unsolicited offers of help to this computer are allowed. This has the possibility of allowing unauthorized users access to a system.

STIG	Date
Windows 7 Security Technical Implementation Guide	2013-10-01

Details

Check Text ( C-32863r1_chk )
If the following registry value doesn’t exist or is not configured as specified this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fAllowUnsolicited Type: REG_DWORD Value: 0 Documentable: Yes Documentable Explanation: Offer remote assistance can be enabled on workstations if mitigations are in place. This must be documented with the IAO. Mitigations: -Users must be trained to include the following: -Who they can accept assistance offer from. Offer must be in response to help desk request or confirmed with help desk if unsolicited offer comes through. -Users must know how to accept request, allow view or control, and how to disconnect a remote assistance session. -Users needs monitor the assistance activity at the workstation while it is occurring. -The support personnel allowed to offer assistance (helpers) must be limited and documented. -Port 3389 should be blocked at the perimeter to prevent other access. Accounts and groups authorized to offer remote assistance (helpers) are identified in the following registry key. Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ RAUnsolicit\ Each Account or group will be listed under a separate value name with the value equaling the value name as in the following examples. Value Name: Administrators Type: REG_SZ Value: Administrators Value Name: TestUser Type: REG_SZ Value: TestUser

Check Text ( C-32863r1_chk )

If the following registry value doesn’t exist or is not configured as specified this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\

Value Name: fAllowUnsolicited

Type: REG_DWORD
Value: 0

Documentable: Yes
Documentable Explanation: Offer remote assistance can be enabled on workstations if mitigations are in place. This must be documented with the IAO.

Mitigations:
-Users must be trained to include the following:
-Who they can accept assistance offer from. Offer must be in response to help desk request or confirmed with help desk if unsolicited offer comes through.
-Users must know how to accept request, allow view or control, and how to disconnect a remote assistance session.
-Users needs monitor the assistance activity at the workstation while it is occurring.

-The support personnel allowed to offer assistance (helpers) must be limited and documented.

-Port 3389 should be blocked at the perimeter to prevent other access.

Accounts and groups authorized to offer remote assistance (helpers) are identified in the following registry key.

Registry Hive: HKEY_LOCAL_MACHINE
Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ RAUnsolicit\

Each Account or group will be listed under a separate value name with the value equaling the value name as in the following examples.

Value Name: Administrators
Type: REG_SZ
Value: Administrators

Value Name: TestUser
Type: REG_SZ
Value: TestUser

Fix Text (F-6776r1_fix)
Configure the system to prevent unsolicited remote assistance offers by setting the policy value for Computer Configuration -> Administrative Templates -> System -> Remote Assistance “Offer Remote Assistance” to “Disabled”.