Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
Global object access auditing of the registry must be configured to record failures.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-1088 | WN12-AU-000116 | SV-52844r2_rule | ECAR-3 | Medium |
| Description |
|---|
| Improper modification of the registry can have a significant impact on the security configuration of a system, as well as potentially rendering a system inoperable. Failed access attempts may indicate an attack on a system. Auditing for failed access attempts provides an indicator of such attempts and a method of determining responsible parties. |
| STIG | Date |
|---|---|
| Windows Server 2012 / 2012 R2 Domain Controller Security Technical Implementation Guide | 2015-09-02 |
Details
| Check Text ( C-47161r2_chk ) |
|---|
| If "Object Access -> Registry" auditing is not properly configured (V-26545), this is a finding. If "Global Object Access Auditing" of the registry has not been configured to audit all failed access attempts for the "Everyone" group, this is a finding. Use the AuditPol tool to review the current configuration. Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "Auditpol /resourceSACL /type:Key /view". ("Key" in the /type parameter is case sensitive). The following results should be displayed: Entry: 1 Resource Type: Key User: Everyone Flags: Failure Condition Accesses: KEY_ALL_ACCESS |
| Fix Text (F-45770r2_fix) |
|---|
| Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> System Audit Policies -> Global Object Access Auditing -> "Registry" with the following: Principal: Everyone Type: Fail Permissions: all categories selected |