Detections
Analytics

2.2.22 Ensure 'Generate security audits' is set to 'LOCAL SERVICE, NETWORK SERVICE, RESTRICTED SERVICES\PrintSpoolerService'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting determines which users or processes can generate audit records in the Security log.

The recommended state for this setting is: LOCAL SERVICE, NETWORK SERVICE, and RESTRICTED SERVICES\PrintSpoolerService.

Note: This user right is considered a 'sensitive privilege' for the purposes of auditing.

A threat actor could use this capability to create a large number of audited events, which would make it more difficult for a system administrator to locate any illicit activity. Also, if the event log is configured to overwrite events as needed, any evidence of unauthorized activities could be overwritten.

Solution

To establish the recommended configuration via GP, set the following UI path to LOCAL SERVICE, NETWORK SERVICE, and RESTRICTED SERVICES\PrintSpoolerService :

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Generate security audits

Impact:

On most computers, this is the default configuration and there will be no negative impact. However, if Web Server (IIS) is installed, the IIS application pool(s) must be granted this user right.

See Also

https://workbench.cisecurity.org/benchmarks/26296

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-2, 800-53|AC-3, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4), CSCv7|6.2

Plugin: Windows

Control ID: 79a18f33084d759e5c6a5c48c7e0b1ebd3270d452b9e0136c0c9e70e0a5ca744