Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32282	WN12-RG-000002	SV-52956r1_rule	ECCD-1 ECCD-2	High

Description
Permissions on the Active Setup\Installed Components registry key must only allow privileged accounts to add or change registry values. If standard user accounts have this capability, there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.

STIG	Date
Windows Server 2012 / 2012 R2 Domain Controller Security Technical Implementation Guide	2014-12-18

Details

Check Text ( C-47262r1_chk )
Navigate to the following registry key and review the assigned permissions: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components On 64-bit systems, also review the permissions assigned to the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components Verify standard user accounts and groups only have Read permissions to this registry key. If any standard user accounts or groups have greater permissions, this is a finding. The default permissions satisfy this requirement.

Check Text ( C-47262r1_chk )

Navigate to the following registry key and review the assigned permissions:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components

On 64-bit systems, also review the permissions assigned to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components

Verify standard user accounts and groups only have Read permissions to this registry key. If any standard user accounts or groups have greater permissions, this is a finding. The default permissions satisfy this requirement.

Fix Text (F-45882r1_fix)
Ensure only Read permissions are assigned to standard user accounts and groups for the following registry keys. The default configuration satisfies this requirement. All systems: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components 64-bit systems: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components