Detections
Analytics

WN25-UR-000130 - The Windows Server 2025 'Impersonate a client after authentication' user right must only be assigned to Administrators, Service, Local Service, and Network Service.

Information

Inappropriately granting user rights provides system, administrative, and other high-level capabilities.

The 'Impersonate a client after authentication' user right allows a program to impersonate another user or account to run on their behalf. An attacker could use this to elevate privileges.

Solution

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> Impersonate a client after authentication to include only the following accounts or groups:
- Administrators.
- Service.
- Local Service.
- Network Service.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2025_V1R1_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(10), CAT|II, CCI|CCI-002235, Rule-ID|SV-278253r1182221_rule, STIG-ID|WN25-UR-000130, Vuln-ID|V-278253

Plugin: Windows

Control ID: c37c94e1049043e9cf1545cb37628e1a7b20494de34be88f1028181e8cf7e08c