Detections
Analytics

2.2.13 Ensure 'Create a pagefile' is set to 'Administrators'

Information

This policy setting allows users to change the size of the pagefile. The page file is a hidden system file on the hard drive that serves as an extension of the system's RAM. When physical memory is full, the system moves less frequently used data to the page file to free up RAM for active processes

The recommended state for this setting is: Administrators.

Note: Certain policy settings must be configured in the Default Domain Controller Policy to ensure they are applied globally to domain controllers. Exercise caution when modifying these policies, as improper changes can negatively impact the environment.

Only policies that are configured by Microsoft by default should reside in these baseline GPOs. Any additional or custom policy settings should be implemented through separate GPOs rather than modifying the default policies.

Users who can change the page file size could make it extremely small or move the file to a highly fragmented storage volume, which could cause reduced computer performance.

Solution

To establish the recommended configuration via GP, set the following UI path to Administrators :

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Create a pagefile

Impact:

None - this is the default behavior.

See Also

https://workbench.cisecurity.org/benchmarks/27461

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-2, 800-53|AC-3, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4)

Plugin: Windows

Control ID: 96204ece1cdfe3f33676e5f0bd2df3ada71208b4d5bafef62451b0904e4cdac3