UCF STIG Viewer Logo

Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key.


Overview

Finding ID Version Rule ID IA Controls Severity
V-32282 WN12-RG-000002 SV-52956r1_rule ECCD-1 ECCD-2 High
Description
Permissions on the Active Setup\Installed Components registry key must only allow privileged accounts to add or change registry values. If standard user accounts have this capability, there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.
STIG Date
Windows Server 2012 Member Server Security Technical Implementation Guide 2014-01-07

Details

Check Text ( C-47262r1_chk )
Navigate to the following registry key and review the assigned permissions:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components

On 64-bit systems, also review the permissions assigned to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components

Verify standard user accounts and groups only have Read permissions to this registry key. If any standard user accounts or groups have greater permissions, this is a finding. The default permissions satisfy this requirement.
Fix Text (F-45882r1_fix)
Ensure only Read permissions are assigned to standard user accounts and groups for the following registry keys. The default configuration satisfies this requirement.
All systems:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components
64-bit systems:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components