WINRG-000001 - Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key.

Information

Permissions on the Active Setup\Installed Components registry key must only allow privileged accounts to add or change registry values. If standard user accounts have this capability there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.

Solution

Maintain the default permissions of the following registry keys-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\ (64-bit systems only)

Users - Read
Administrators - Full Control
SYSTEM - Full Control
CREATOR OWNER - Special
(Special = Full Control - Subkeys only)

See Also

http://iasecontent.disa.mil/stigs/zip/Oct2016/U_Windows_Vista_V6R41_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(10), CAT|I, CCI|CCI-002235, Rule-ID|SV-42616r2_rule, STIG-ID|WINRG-000001, Vuln-ID|V-32282

Plugin: Windows

Control ID: d6d0e6f7d9110d16d5f37e1c82feb7b46bbac5a3c0dac79c0b8e78c8a92fe986