Users must be prevented from connecting using Remote Desktop Services.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-14248	WN08-CC-000097	SV-48204r3_rule		Medium

Description
Allowing a remote desktop session to a workstation enables another avenue of access that could be exploited. The system must be configured to prevent users from connecting to a computer using Remote Desktop Services.

STIG	Date
Windows 8/8.1 Security Technical Implementation Guide	2017-04-28

Details

Check Text ( None )
None

Fix Text (F-67151r3_fix)
Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Connections >> "Allow users to connect remotely by using Remote Desktop Services" to "Disabled". If Remote Desktop Services for remote administration is necessary, enabling this would not be a finding. Restricted Admin mode must be used. This must be document with the ISSO. See Microsoft article KB2871997 for patches required to add this function to systems prior to Windows 8.1. Restricted Admin mode for Remote Desktop Connections can be implemented for each session using a command line switch to start the Remote Desktop Client or through a group policy to enable it for all sessions. The command line to do this is "mstsc /restrictedadmin". To enable this with group policy, configure the policy value for Computer Configuration >> Administrative Templates >> System >> Credentials Delegation >> "Restrict delegation of credentials to remote servers" to "Enabled".

Fix Text (F-67151r3_fix)

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Connections >> "Allow users to connect remotely by using Remote Desktop Services" to "Disabled".

If Remote Desktop Services for remote administration is necessary, enabling this would not be a finding. Restricted Admin mode must be used. This must be document with the ISSO.
See Microsoft article KB2871997 for patches required to add this function to systems prior to Windows 8.1.

Restricted Admin mode for Remote Desktop Connections can be implemented for each session using a command line switch to start the Remote Desktop Client or through a group policy to enable it for all sessions.

The command line to do this is "mstsc /restrictedadmin".

To enable this with group policy, configure the policy value for Computer Configuration >> Administrative Templates >> System >> Credentials Delegation >> "Restrict delegation of credentials to remote servers" to "Enabled".