Detections
Analytics

1.254 WN16-UR-000050

Information

The Allow log on locally user right must only be assigned to the Administrators group.

GROUP ID: V-225072
RULE ID: SV-225072r958472

Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.

Accounts with the 'Allow log on locally' user right can log on interactively to a system.

Solution

Configure the policy value for

Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> 'Allow log on locally'

to include only the following accounts or groups:

 - Administrators

See Also

https://workbench.cisecurity.org/benchmarks/23093

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3, CAT|II, CCI|CCI-000213, Rule-ID|SV-225072r958472_rule, STIG-ID|WN16-UR-000050, Vuln-ID|V-225072

Plugin: Windows

Control ID: 2a333280c6dd1dd579a07313086851bc02a9091eac2e2261920b9641832b6e4b