Detections
Analytics

5.26 (L2) Ensure 'Remote Registry (RemoteRegistry)' is set to 'Disabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Enables remote users to view and modify registry settings on this computer.

The recommended state for this setting is: Disabled.

In a high security environment, exposing the registry to remote access is an increased security risk.

Solution

To establish the recommended configuration via GP, set the following UI path to: Disabled.

Computer Configuration\Policies\Windows Settings\Security Settings\System Services\Remote Registry

Impact:

The registry can be viewed and modified only by users on the computer.

Note: Many remote administration tools, such as System Center Configuration Manager (SCCM), require the Remote Registry service to be operational for remote management. In addition, many vulnerability scanners use this service to access the registry remotely.

See Also

https://workbench.cisecurity.org/benchmarks/21994

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Windows

Control ID: 451f2c2d363f0ae545ac8f0db2d89f50ad5e72028b8fd35e7c2d7dca5de9f4f6