Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32282	WN08-RG-000002	SV-48295r1_rule	ECCD-1 ECCD-2	High

Description
Permissions on the Active Setup\Installed Components registry key must only allow privileged accounts to add or change registry values. If standard user accounts have this capability, there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.

STIG	Date
Windows 8 / 8.1 Security Technical Implementation Guide	2014-04-02

Details

Check Text ( C-44973r1_chk )
Navigate to the following registry key and review the assigned permissions: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components On 64-bit systems, also review the permissions assigned to the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components Verify that standard user accounts and groups only have Read permissions to this registry key. If any standard user accounts or groups have greater permissions this is a finding. The default permissions satisfy this requirement.

Check Text ( C-44973r1_chk )

Navigate to the following registry key and review the assigned permissions:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components

On 64-bit systems, also review the permissions assigned to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components

Verify that standard user accounts and groups only have Read permissions to this registry key. If any standard user accounts or groups have greater permissions this is a finding. The default permissions satisfy this requirement.

Fix Text (F-41430r1_fix)
Ensure only Read permissions are assigned to standard user accounts and groups for the following registry keys. The default configuration satisfies this requirement. All systems: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components 64-bit systems: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components