Detections
Analytics

4.11.54.2.1 Ensure 'Allow Basic authentication' is set to 'Disabled'

Information

This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts Basic authentication from a remote client.

The recommended state for this setting is: Disabled.

Basic authentication is less robust than other authentication methods available in WinRM because credentials including passwords are transmitted in plain text. An attacker who is able to capture packets on the network where WinRM is running may be able to determine the credentials used for accessing remote hosts via WinRM.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Disabled.

Administrative Templates\Windows Components\Windows Remote Management (WinRM)\WinRM Service\Allow Basic authentication

Impact:

None - this is the default behavior.

See Also

https://workbench.cisecurity.org/benchmarks/27291

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|16.5

Plugin: Windows

Control ID: d210fa274e671beafb851e3c9302b67dd22a8a92856d0e7ab1038dd41280f124