Detections
Analytics

18.8.22.1.13 Ensure 'Turn off Windows Error Reporting' is set to 'Enabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting controls whether or not errors are reported to Microsoft.

Error Reporting is used to report information about a system or application that has failed or has stopped responding and is used to improve the quality of the product.

The recommended state for this setting is: 'Enabled'.

Rationale:
If a Windows Error occurs in a secure, enterprise managed environment, the error should be reported directly to IT staff for troubleshooting and remediation.

There is no benefit to the corporation to report these errors directly to Microsoft, and there is some risk of unknowingly exposing sensitive data as part of the error.

Solution

To establish the recommended configuration via GP, set the following UI path to 'Enabled':


Computer Configuration\Policies\Administrative Templates\System\Internet Communication Management\Internet Communication settings\Turn off Windows Error Reporting


Note: This Group Policy path is provided by the Group Policy template 'ICM.admx/adml' that is included with all versions of the Microsoft Windows Administrative Templates.

Impact:
Users are not given the option to report errors to Microsoft.

See Also

https://workbench.cisecurity.org/files/1937

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-11, CSCv6|13

Plugin: Windows

Control ID: 9b6a1579cbe19af8938e6ceee64b27726d0d50d0e089bb141ff2fb3a42e740f5