Detections
Analytics

5.42 (L2) Ensure 'WinHTTP Web Proxy Auto-Discovery Service (WinHttpAutoProxySvc)' is set to 'Disabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

WinHTTP implements the client HTTP stack and provides developers with a Win32 API and COM Automation component for sending HTTP requests and receiving responses. In addition, WinHTTP provides support for auto-discovering a proxy configuration via its implementation of the Web Proxy Auto-Discovery (WPAD) protocol.

The recommended state for this setting is: Disabled.

Note: Although CIS categorizes this as a L2 recommendation, if none of the cases listed in the Impact Section apply, we highly recommend disabling this service.

This service is primarily needed to support Web Proxy Auto-Discovery (WPAD), which is an auto-proxy discovery mechanism that could expose the computer to Man-In-The-Middle (MITM) attacks. If an organization depends on HTTP proxy configuration, it is recommended that other client configuration mechanisms be used instead, such as Group Policy.

Solution

To establish the recommended configuration via GP, set the following UI path to: Disabled.

Computer Configuration\Policies\Windows Settings\Security Settings\System Services\WinHTTP Web Proxy Auto-Discovery Service

Impact:

WPAD will cease to function for automatic HTTP proxy routing, which may prevent Internet connectivity for workstations in organizations that currently use WPAD. Microsoft also cautions that some software that uses the network stack may have a functional dependency on this service, so it is advised that you test disabling this service on a representation of user workstations and applications before disabling it across the entire organization.

Beginning with Windows 10 Release 1709, Microsoft changed the WPAD service to tightly integrate it with all proxy activity. Disabling this service now has these additional impacts:

 - The ability to set a manual (not just auto) proxy configuration.
 - Some VPN clients require the WPAD service, so disabling WPAD breaks them.
 - Some network-related applications will not work without WPAD running (e.g. Fiddler).

See Also

https://workbench.cisecurity.org/benchmarks/21994

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Windows

Control ID: 3e0f9711a7c0baa38455097b79052249f7f13abbd4b6d76115422cd3f6931cf5