Detections
Analytics

2.2.17 Ensure 'Deny log on as a service' to include 'Guests'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This security setting determines which service accounts are prevented from registering a process as a service. This user right supersedes the Log on as a service user right if an account is subject to both policies.

The recommended state for this setting is to include: Guests.

Note: This security setting does not apply to the System, Local Service, or Network Service accounts.

Accounts that can log on as a service could be used to configure and start new unauthorized services, such as a keylogger or other malicious software. The benefit of the specified countermeasure is somewhat reduced by the fact that only users with administrative privileges can install and configure services, and a threat actor who has already attained that level of access could configure the service to run with the System account.

Solution

To establish the recommended configuration via GP, set the following UI path to include Guests :

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny log on as a service

Impact:

If you assign the Deny log on as a service user right to specific accounts, services may not be able to start and a DoS condition could result.

See Also

https://workbench.cisecurity.org/benchmarks/26296

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-2, 800-53|AC-3, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4)

Plugin: Windows

Control ID: 9949b01df446eca84d2c326044c7ab826774702b2aad229118c63d5f91126e13