Detections
Analytics

5.23 Ensure 'Remote Desktop Services UserMode Port Redirector (UmRdpService)' is set to 'Disabled'

Information

Allows the redirection of Printers/Drives/Ports for RDP connections.

The recommended state for this setting is: Disabled.

In a security-sensitive environment, it is desirable to reduce the possible attack surface - preventing the redirection of COM, LPT and PnP ports will reduce the number of unexpected avenues for data exfiltration and/or malicious code transfer within an RDP session.

Solution

To establish the recommended configuration, run the following PowerShell command:

Set-Service -Name UmRdpService -StartupType Disabled

Impact:

Printers, drives and ports (COM, LPT, PnP, etc.) will not be allowed to be redirected inside RDP sessions.

See Also

https://workbench.cisecurity.org/benchmarks/28052

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Windows

Control ID: 66133a379e49c62dce3b11c58770fda3d89b653193d70716fb64d1e8b69f5166