Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-26070 | 2.023 | SV-33307r2_rule | High |
Description |
---|
Permissions on the Winlogon registry key must only allow privileged accounts to change registry values. If standard users have this capability there is a potential for programs to run with elevated privileges when a privileged user logs on to the system. |
STIG | Date |
---|---|
Windows Vista Security Technical Implementation Guide | 2016-06-03 |
Check Text ( C-66317r1_chk ) |
---|
Run "Regedit". Navigate to the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ Review the permissions. If the default permissions listed below have been changed, this is a finding. Users - Read Administrators - Full Control SYSTEM - Full Control CREATOR OWNER - Special (Special = Full Control - Subkeys only) |
Fix Text (F-71705r1_fix) |
---|
Maintain the default permissions of the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ Users - Read Administrators - Full Control SYSTEM - Full Control CREATOR OWNER - Special (Special = Full Control - Subkeys only) |