Detections
Analytics

2.3.7.1 Ensure 'Interactive logon: Do not require CTRL+ALT+DEL' is set to 'Disabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting determines whether users must press CTRL+ALT+DEL before they log on.

The recommended state for this setting is: Disabled.

If users are not required to press CTRL+ALT+DEL, they are susceptible to attacks that attempt to intercept their passwords. If CTRL+ALT+DEL is required before logon, user passwords are communicated by means of a trusted path.

A threat actor could install a Trojan horse program that looks like the standard Windows logon dialog box and capture the user's password. The threat actor would then be able to log on to the compromised account with whatever level of privilege that user has.

Solution

To establish the recommended configuration via GP, set the following UI path to Disabled :

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Interactive logon: Do not require CTRL+ALT+DEL

Impact:

Users must press CTRL+ALT+DEL before they log on to Windows unless they use a smart card for Windows logon. A smart card is a tamper-proof device that stores security information.

See Also

https://workbench.cisecurity.org/benchmarks/25708

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-7, 800-53|AC-19

Plugin: Windows

Control ID: 3ee907fe1c47ef9ccbcff4ba46b2bd4da5fe3c88e3185542177423799fa54ced