Detections
Analytics

2.2.7 Configure 'Allow log on through Remote Desktop Services'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting determines which users or groups have the right to log on as a Remote Desktop Services client. If your organization uses Remote Assistance as part of its help desk strategy, create a group and assign it this user right through Group Policy. If the help desk in your organization does not use Remote Assistance, assign this user right only to the 'Administrators' group or use the Restricted Groups feature to ensure that no user accounts are part of the 'Remote Desktop Users' group.

Restrict this user right to the 'Administrators' group, and possibly the 'Remote Desktop Users' group, to prevent unwanted users from gaining access to computers on your network by means of the Remote Assistance feature.

- Level 1 - Domain Controller. The recommended state for this setting is: 'Administrators'.
- Level 1 - Member Server. The recommended state for this setting is: 'Administrators, Remote Desktop Users'.

Note: A Member Server that holds the _Remote Desktop Services_ Role with _Remote Desktop Connection Broker_ Role Service will require a special exception to this recommendation, to allow the 'Authenticated Users' group to be granted this user right.

Note #2: The above lists are to be treated as whitelists, which implies that the above principals need not be present for assessment of this recommendation to pass.

Note #3: In all versions of Windows Server prior to Server 2008 R2, Remote Desktop Services was known as Terminal Services, so you should substitute the older term if comparing against an older OS.

Rationale:
Any account with the Allow log on through Remote Desktop Services user right can log on to the remote console of the computer. If you do not restrict this user right to legitimate users who need to log on to the console of the computer, unauthorized users could download and run malicious software to elevate their privileges.

Solution

To establish the recommended configuration via GP, configure the following UI path:


Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on through Remote Desktop Services


Impact:
Removal of the Allow log on through Remote Desktop Services user right from other groups or membership changes in these default groups could limit the abilities of users who perform specific administrative roles in your environment. You should confirm that delegated activities will not be adversely affected.

See Also

https://workbench.cisecurity.org/files/1949

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(7), CCE|CCE-37072-6, CSCv6|16

Plugin: Windows

Control ID: 3940ba558604fbb4da351b85e96fcdd2cc05bf48f6af3a5d1c64c763ba57dc4e