Detections
Analytics

18.9.97.2.2 Ensure 'Allow remote server management through WinRM' is set to 'Disabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting allows you to manage whether the Windows Remote Management (WinRM) service automatically listens on the network for requests on the HTTP transport over the default HTTP port.

The recommended state for this setting is: 'Disabled'.

Rationale:
Any feature is a potential avenue of attack, those that enable inbound network connections are particularly risky.

Only enable the use of the Windows Remote Management (WinRM) service on trusted networks and when feasible employ additional controls such as IPsec.

Solution

To establish the recommended configuration via GP, set the following UI path to 'Disabled:'


Computer Configuration\Administrative Templates\Windows Components\Windows Remote Management (WinRM)\WinRM Service\Allow remote server management through WinRM


Note: This Group Policy path is provided by the Group Policy template 'WindowsRemoteManagement.admx/adml' that is included with all versions of the Microsoft Windows Administrative Templates.

Note #2: In older Microsoft Windows Administrative Templates, this setting was initially named _Allow automatic configuration of listeners_, but it was renamed starting with the Windows 8.0 & Server 2012 (non-R2) Administrative Templates.

Impact:
None - this is the default behavior.

See Also

https://workbench.cisecurity.org/files/1937

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-17(4), CSCv6|3.4

Plugin: Windows

Control ID: e3955b66a3619c63dd267b1e2e50d76b035e203eeecaaa40b6493a7e643f5e3d