Detections
Analytics

2.2.7 Ensure 'Allow log on locally' is set to 'Administrators, ENTERPRISE DOMAIN CONTROLLERS' (DC only)

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting determines which users can interactively log on to computers in your environment. Logons that are initiated by pressing the CTRL+ALT+DEL key sequence on the client computer keyboard require this user right. Users who attempt to log on through Terminal Services / Remote Desktop Services or IIS also require this user right.

The recommended state for this setting on Domain Controllers is: Administrators, ENTERPRISE DOMAIN CONTROLLERS.

Note: This user right should generally be restricted to the Administrators group. Assign this user right to the Backup Operators group if your organization requires that they have this capability.

Note #2: When a server is promoted to a Domain Controller ENTERPRISE DOMAIN CONTROLLERS is granted this user right by default.

Any account with the Allow log on locally user right can log on at the console of the computer. If you do not restrict this user right to legitimate users who need to be able to log on to the console of the computer, unauthorized users could download and run malicious software to elevate their privileges.

Solution

To establish the recommended configuration via GP, configure the following UI path to Administrators, ENTERPRISE DOMAIN CONTROLLERS :

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on locally

Impact:

If you remove these default groups, you could limit the abilities of users who are assigned to specific administrative roles in your environment. You should confirm that delegated activities will not be adversely affected by any changes that you make to the Allow log on locally user right.

See Also

https://workbench.cisecurity.org/benchmarks/25708

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-2, 800-53|AC-3, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4)

Plugin: Windows

Control ID: bf0ffadbf0a5f1fada652e55f1e71f0a7c82098f51bdd1a137205c28cfc136c2