Detections
Analytics

1.239 WN11-UR-000025

Information

The 'Allow log on locally' user right must only be assigned to the Administrators and Users groups.

GROUP ID: V-253482
RULE ID: SV-253482r1137691

Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.

Accounts with the 'Allow log on locally' user right can log on interactively to a system.

Solution

Configure the policy value for

Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> 'Allow log on locally'

to only include the following groups or accounts:

Administrators
Users

See Also

https://workbench.cisecurity.org/benchmarks/27756

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3, CCI|CCI-000213, Rule-ID|SV-253482r1137691_rule, STIG-ID|WN11-UR-000025, Vuln-ID|V-253482

Plugin: Windows

Control ID: 5a3bb2be948bc1f38759c42264952a6570b639030a16ad9cdb0f9aa0e31bb676