Detections
Analytics

1.242 WN16-SO-000450

Information

The default permissions of global system objects must be strengthened.

GROUP ID: V-225060
RULE ID: SV-225060r991589

Windows systems maintain a global list of shared system resources such as DOS device names, mutexes, and semaphores. Each type of object is created with a default Discretionary Access Control List (DACL) that specifies who can access the objects with what permissions. When this policy is enabled, the default DACL is stronger, allowing non-administrative users to read shared objects but not to modify shared objects they did not create.

Solution

Configure the policy value for

Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> 'System objects: Strengthen default permissions of internal system objects (e.g., Symbolic Links)'

to 'Enabled'.

See Also

https://workbench.cisecurity.org/benchmarks/23093

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-225060r991589_rule, STIG-ID|WN16-SO-000450, Vuln-ID|V-225060

Plugin: Windows

Control ID: 9a2f3d39634de48077f3d74f9387e84598ade9275b9b0bc8d22928ee8f691d63