Detections
Analytics

18.9.97.2.2 Ensure 'Allow remote server management through WinRM' is set to 'Disabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting allows you to manage whether the Windows Remote Management (WinRM) service automatically listens on the network for requests on the HTTP transport over the default HTTP port.
The recommended state for this setting is: Disabled.

Solution

To implement the recommended configuration state, set the following Group Policy setting to Disabled:
Computer Configuration\Administrative Templates\Windows Components\Windows Remote Management (WinRM)\WinRM Service\Allow remote server management through WinRM

See Also

https://workbench.cisecurity.org/files/1941

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-17(4), CSCv6|3.4

Plugin: Windows

Control ID: 9b49c45d2ad38f40e509d4a6be3178b31d13c9080cea18310178ed3929184bfc