5.19 (L2) Ensure 'Remote Desktop Services UserMode Port Redirector (UmRdpService)' is set to 'Disabled'

Information

Allows the redirection of Printers/Drives/Ports for RDP connections.
The recommended state for this setting is: Disabled.

Rationale:
In a security-sensitive environment, it is desirable to reduce the possible attack surface - preventing the redirection of COM, LPT and PnP ports will reduce the number of unexpected avenues for data exfiltration and/or malicious code transfer within an RDP session.

Solution

To establish the recommended configuration via GP, set the following UI path to: Disabled.
Computer Configuration\Policies\Windows Settings\Security Settings\System Services\Remote Desktop Services UserMode Port Redirector

Impact:
Printers, drives and ports (COM, LPT, PnP, etc.) will not be allowed to be redirected inside RDP sessions.

Default Value:
Manual

See Also

https://workbench.cisecurity.org/files/2754

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv6|9.1, CSCv7|9.2

Plugin: Windows

Control ID: f8dd0d9ff6692ecdfcaac6bd7bd1ea4f381a7ee0d66c65b08839d4a3a9544538