Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-32282 | WINRG-000001 | SV-42618r1_rule | ECCD-1 ECCD-2 | High |
Description |
---|
Permissions on the Active Setup\Installed Components registry key must only allow privileged accounts to add or change registry values. If standard user accounts have this capability there is a potential for programs to run with elevated privileges when a privileged user logs on to the system. |
STIG | Date |
---|---|
Windows 7 Security Technical Implementation Guide | 2015-03-09 |
Check Text ( C-40783r2_chk ) |
---|
Navigate to the following registry key and review the assigned permissions: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components On 64-bit systems also review the permissions assigned to the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components Verify that standard user accounts and groups only have Read permissions to this registry key. If any standard user accounts or groups have greater permissions this is a finding. The default permissions satisfy this requirement. |
Fix Text (F-36207r3_fix) |
---|
Ensure only Read permissions are assigned to standard user accounts and groups for the following registry keys. The default configuration satisfies this requirement. All systems HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components 64-bit systems HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components |