Detections
Analytics

18.9.97.2.1 (L1) Ensure 'Allow Basic authentication' is set to 'Disabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts Basic authentication from a remote client.
The recommended state for this setting is: Disabled.

Rationale:
Basic authentication is less robust than other authentication methods available in WinRM because credentials including passwords are transmitted in plain text. An attacker who is able to capture packets on the network where WinRM is running may be able to determine the credentials used for accessing remote hosts via WinRM.

Solution

To establish the recommended configuration via GP, set the following UI path to Disabled:
Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Remote Management (WinRM)\WinRM Service\Allow Basic authentication
Note: This Group Policy path is provided by the Group Policy template WindowsRemoteManagement.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.

Impact:
None - this is the default behavior.

Default Value:
Disabled. (The WinRM service will not accept Basic authentication from a remote client.)

References:
1. CCE-34779-9

See Also

https://workbench.cisecurity.org/files/2754

Item Details

References: CSCv6|16.13, CSCv7|14.4, CSCv7|16.5

Plugin: Windows

Control ID: 7ae0a388b1d53c36b4456ffebd025fa6e3d731c6f4b58d736392b3c40c555d5c