Detections
Analytics

2.2.7 Ensure 'Allow log on locally' is set to 'Administrators'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting determines which users can interactively log on to computers in your environment. Logons that are initiated by pressing the CTRL+ALT+DEL key sequence on the client computer keyboard require this user right. Users who attempt to log on through Terminal Services / Remote Desktop Services or IIS also require this user right.

The recommended state for this setting is: Administrators.

Note: This user right should generally be restricted to the Administrators group. Assign this user right to the Backup Operators group if your organization requires that they have this capability.

Rationale:

Any account with the Allow log on locally user right can log on at the console of the computer. If you do not restrict this user right to legitimate users who need to be able to log on to the console of the computer, unauthorized users could download and run malicious software to elevate their privileges.

Solution

To establish the recommended configuration via GP, configure the following UI path:

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on locally




Impact:

If you remove these default groups, you could limit the abilities of users who are assigned to specific administrative roles in your environment. You should confirm that delegated activities will not be adversely affected by any changes that you make to the Allow log on locally user right.

Default Value:

On Member Servers: Administrators, Backup Operators, Users.

On Domain Controllers: Account Operators, Administrators, Backup Operators, Print Operators.

References:

CCE-37659-0

See Also

https://workbench.cisecurity.org/files/2742

Item Details

References: CSCv6|16, CSCv7|4.1, CSCv7|4.3, CSCv7|4.5

Plugin: Windows

Control ID: 465040c5ea488f6698d894d1bf3926dd457f4e869e87ccc3b79f9c4d364a4ea2