Detections
Analytics

1.177 WN11-CC-000355

Information

The Windows Remote Management (WinRM) service must not store RunAs credentials.

GROUP ID: V-253420
RULE ID: SV-253420r1051055

Storage of administrative credentials could allow unauthorized access. Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins.

Solution

Configure the policy value for

Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> 'Disallow WinRM from storing RunAs credentials'

to 'Enabled'.

See Also

https://workbench.cisecurity.org/benchmarks/27756

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-11, CCI|CCI-002038, Rule-ID|SV-253420r1051055_rule, STIG-ID|WN11-CC-000355, Vuln-ID|V-253420

Plugin: Windows

Control ID: 5ce23222778a3751a2766366bcb3e93241902295d8466eeb09773b7cc42f095f