Detections
Analytics

5.30 Ensure 'Special Administration Console Helper (sacsvr)' is set to 'Disabled' or 'Not Installed'

Information

This service allows administrators to remotely access a command prompt using Emergency Management Services.

The recommended state for this setting is: Disabled or Not Installed.

Note: This service is not installed by default. It is supplied with Windows, but it is installed by enabling an optional Windows capability (Windows Emergency Management Services and Serial Console).

Allowing the use of a remotely accessible command prompt that provides the ability to perform remote management tasks on a computer is a security risk.

Solution

To establish the recommended configuration via GP, set the following UI path to: Disabled or ensure the service is not installed.

Computer Configuration\Policies\Windows Settings\Security Settings\System Services\Special Administration Console Helper

Impact:

Users will not have access to a remote command prompt using Emergency Management Services.

See Also

https://workbench.cisecurity.org/benchmarks/27832

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Windows

Control ID: 7a569871b1d8f8e393f0c334ec66877816a2834fd1fa30346806f856b0043506