Detections
Analytics

2.2.36 Ensure 'Restore files and directories' is set to 'Administrators'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting determines which users can bypass file, directory, registry, and other persistent object permissions when restoring backed up files and directories on systems that run Windows Vista (or newer).

This user right also determines which users can set valid security principals as object owners; it is similar to the Back up files and directories user right.

The recommended state for this setting is: Administrators.

Note: This user right is considered a 'sensitive privilege' for the purposes of auditing.

A threat actor with the Restore files and directories user right could restore sensitive data to a computer and overwrite data that is more recent, which could lead to loss of important data, data corruption, or a denial-of-service (DoS).

Threat actors could overwrite executable files that are used by legitimate administrators or system services with versions that include malicious software to grant themselves elevated privileges, compromise data, or install backdoors for continued access to the computer.

Note: Even if the following countermeasure is configured, a threat actor could still restore data to a computer in a domain that is controlled by the actor. Therefore, it is critical that organizations carefully protect the media that is used to back up data.

Solution

To establish the recommended configuration via GP, set the following UI path to Administrators :

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Restore files and directories

Impact:

Removing the 'Restore files and directories' user right from the Backup Operators group or other delegated accounts may prevent authorized users from performing essential tasks. Before making this change, it's important to assess whether it will disrupt operational responsibilities.

See Also

https://workbench.cisecurity.org/benchmarks/26296

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-2, 800-53|AC-3, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4)

Plugin: Windows

Control ID: d2e10b7e9c90709368b7a6b2b31221b73249647eeefb4355d8c58fb2e1c28df3