Users must be prevented from connecting using Remote Desktop Services.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-14248	WN08-CC-000097	SV-48204r1_rule	ECSC-1	Medium

Description
Allowing a remote desktop session to a workstation enables another avenue of access that could be exploited. The system must be configured to prevent users from connecting to a computer using Remote Desktop Services.

STIG	Date
Windows 8 Security Technical Implementation Guide	2014-01-07

Details

Check Text ( C-44883r1_chk )
If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fDenyTSConnections Type: REG_DWORD Value: 1 If remote desktop for remote administration is being used, this would not be a finding. This must to be documented with the IAO.

Fix Text (F-41340r1_fix)
Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Connections -> "Allow users to connect remotely by using Remote Desktop Services" to "Disabled.