Detections
Analytics

1.144 WN16-CC-000550

Information

The Windows Remote Management (WinRM) service must not store RunAs credentials.

GROUP ID: V-224963
RULE ID: SV-224963r1050790

Storage of administrative credentials could allow unauthorized access. Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins.

Satisfies: SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00156

Solution

Configure the policy value for

Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> 'Disallow WinRM from storing RunAs credentials' to 'Enabled'.

See Also

https://workbench.cisecurity.org/benchmarks/23093

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(10)

Plugin: Windows

Control ID: 72dea14ee0bbbef775806c00babfa9dcc09a7723238ebe00841d45d7e02a4336