Detections
Analytics

4.7.5 (L1) Ensure 'Configure RPC listener settings: Authentication protocol to use for incoming RPC connections:' is set to 'Enabled: Negotiate' or higher

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting controls which protocols incoming Remote Procedure Call (RPC) connections to the print spooler are allowed to use.

The recommended state for this setting is: Enabled: Negotiate or higher.

This setting can prevent the use of named pipes for RPC connections to the print spooler and forces the use of TCP which is a more secure communication method.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Enabled: Negotiate or higher:

Administrative Templates\Printers\Configure RPC listener settings: Configure protocol options for incoming RPC connections

Impact:

Warning: Many existing print configurations may be using the older named pipes protocol and therefore will cease to function.

See Also

https://workbench.cisecurity.org/benchmarks/21719

Item Details

Plugin: Windows

Control ID: 0476edf659c33feb9c99449da86542205aeb415e8b1e5bcf5ceacc3449bdfb20