Detections
Analytics

1.264 WN16-UR-000220

Information

The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.

GROUP ID: V-225082
RULE ID: SV-225082r958726

Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.

The 'Impersonate a client after authentication' user right allows a program to impersonate another user or account to run on their behalf. An attacker could use this to elevate privileges.

Solution

Configure the policy value for

Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> 'Impersonate a client after authentication'

to include only the following accounts or groups:

 - Administrators
 - Service
 - Local Service
 - Network Service

See Also

https://workbench.cisecurity.org/benchmarks/23093

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(10), CAT|II, CCI|CCI-002235, Rule-ID|SV-225082r958726_rule, STIG-ID|WN16-UR-000220, Vuln-ID|V-225082

Plugin: Windows

Control ID: 3732cd6c286f1b210770b5b909d0b42c3988c7e2967a3b51c0925264bed78f5e