Detections
Analytics

2.2.2 Ensure 'Access this computer from the network' is set to 'Administrators, Remote Desktop Users'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting allows other users on the network to connect to the computer and is required by various network protocols that include Server Message Block (SMB)-based protocols, NetBIOS, Common Internet File System (CIFS), and Component Object Model Plus (COM+).

The recommended state for this setting is: 'Administrators, Remote Desktop Users'.

Rationale:

Users who can connect from their computer to the network can access resources on target computers for which they have permission.

For example, the 'Access this computer from the network' user right is required for users to connect to shared printers and folders.

If this user right is assigned to the 'Everyone' group, then anyone will be able to read the files in those shared folders.

However, this situation is unlikely for new installations of Windows Server 2003 with Service Pack 1 (SP1), because the default share and NTFS permissions in Windows Server 2003 do not include the 'Everyone' group.

This vulnerability may have a higher level of risk for computers that you upgrade from Windows NT 4.0 or Windows 2000, because the default permissions for these operating systems are not as restrictive as the default permissions in Windows Server 2003.

Solution

To establish the recommended configuration via GP, set the following UI path to 'Administrators, Remote Desktop Users':

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Access this computer from the network

Impact:

If you remove the 'Access this computer from the network' user right on Domain Controllers for all users, no one will be able to log on to the domain or use network resources.

If you remove this user right on Member Servers, users will not be able to connect to those servers through the network.

Successful negotiation of IPsec connections requires that the initiating machine has this right, therefore if using IPsec, it is recommended that it be assigned to the 'Authenticated Users' group.

If you have installed optional components such as ASP.NET or Internet Information Services (IIS), you may need to assign this user right to additional accounts that are required by those components.

It is important to verify that authorized users are assigned this user right for the computers they need to access the network.

See Also

https://workbench.cisecurity.org/files/1933

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(7), CCE|CCE-32928-4, CSCv6|9

Plugin: Windows

Control ID: 259bc9d32407ab431b32bf53fcb910c2bc6a6776bb7d606d2ff19d85f5f06e5f