The file system must be audited for failed access attempts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-1080	2.007	SV-32247r2_rule	ECAR-1 ECAR-2 ECAR-3	Medium

Description
Improper modification of system files can have a significant impact on the security configuration of a system as well as potentially rendering a system inoperable. Failed access attempts may indicate an attack on a system. Auditing for failed access attempts provides an indicator of such attempts and a method of determining responsible parties.

STIG	Date
Windows Server 2008 R2 Member Server Security Technical Implementation Guide	2014-06-27

Details

Check Text ( C-45825r2_chk )
If "Object Access -> File System" auditing is not properly configured (V-26544), or if drives are not formatted with NTFS (V-1081), this is a finding. If "Global Object Access Auditing" of the file system has not been configured to audit all failed access attempts for the "Everyone" group, this is a finding. Use the AuditPol tool to review the current configuration. Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "Auditpol /resourceSACL /type:File /view". ("File" in the /type parameter is case sensitive). The following results should be displayed. Entry: 1 Resource Type: File User: Everyone Flags: Failure Accesses: FILE_READ_DATA FILE_WRITE_DATA FILE_APPEND_DATA FILE_READ_EA FILE_WRITE_EA FILE_EXECUTE FILE_DELETE_CHILD FILE_READ_ATTRIBUTES FILE_WRITE_ATTRIBUTES DELETE READ_CONTROL WRITE_DAC WRITE_OWNER The command was successfully executed. Alternately, file auditing may be configured through Windows Explorer. If configured as follows, this is not a finding. For each drive on the system, view the file auditing configuration. Open Windows Explorer. Right click a drive and select "Properties". Select the "Security" tab. Click "Advanced". Select the "Auditing" tab. Click "Continue" to view auditing properties. Verify the following. Type - Fail Name - Everyone Access - Full control Apply to - This folder, subfolders and files

Check Text ( C-45825r2_chk )

If "Object Access -> File System" auditing is not properly configured (V-26544), or if drives are not formatted with NTFS (V-1081), this is a finding.

If "Global Object Access Auditing" of the file system has not been configured to audit all failed access attempts for the "Everyone" group, this is a finding.

Use the AuditPol tool to review the current configuration.
Open a Command Prompt with elevated privileges ("Run as Administrator").
Enter "Auditpol /resourceSACL /type:File /view". ("File" in the /type parameter is case sensitive).

The following results should be displayed.

Entry: 1
Resource Type: File
User: Everyone
Flags: Failure
Accesses:
FILE_READ_DATA
FILE_WRITE_DATA
FILE_APPEND_DATA
FILE_READ_EA
FILE_WRITE_EA
FILE_EXECUTE
FILE_DELETE_CHILD
FILE_READ_ATTRIBUTES
FILE_WRITE_ATTRIBUTES
DELETE
READ_CONTROL
WRITE_DAC
WRITE_OWNER

The command was successfully executed.

Alternately, file auditing may be configured through Windows Explorer. If configured as follows, this is not a finding.

For each drive on the system, view the file auditing configuration.
Open Windows Explorer.
Right click a drive and select "Properties".
Select the "Security" tab.
Click "Advanced".
Select the "Auditing" tab.
Click "Continue" to view auditing properties.
Verify the following.

Type - Fail
Name - Everyone
Access - Full control
Apply to - This folder, subfolders and files

Fix Text (F-43217r1_fix)
Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Global Object Access Auditing -> "File system" to audit the "Everyone" group for all "Failed" categories.