Detections
Analytics

2.2.19 (L1) Ensure 'Deny log on locally' to include 'Guests'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This security setting determines which users are prevented from logging on at the computer. This policy setting supersedes the Allow log on locally policy setting if an account is subject to both policies.

The recommended state for this setting is to include: Guests.

Important: If you apply this security policy to the Everyone group, no one will be able to log on locally.

Any account with the ability to log on locally could be used to log on at the console of the computer. If this user right is not restricted to legitimate users who need to log on to the console of the computer, unauthorized users might download and run malicious software that elevates their privileges.

Solution

To establish the recommended configuration via GP, set the following UI path to include Guests :

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny log on locally

Impact:

If you assign the Deny log on locally user right to additional accounts, you could limit the abilities of users who are assigned to specific roles in your environment. However, this user right should explicitly be assigned to the ASPNET account on computers that run IIS 6.0. You should confirm that delegated activities will not be adversely affected.

See Also

https://workbench.cisecurity.org/benchmarks/21994

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-2, 800-53|AC-3, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4)

Plugin: Windows

Control ID: ba9fa2fd30ff658ffd9a602b70c1a9968a326efe7a0a775f806b851eca1a2f01