Detections
Analytics
WN25-CC-000370 - Windows Server 2025 Remote Desktop Services must require secure Remote Procedure Call (RPC) communications.
Information
Allowing unsecure RPC communication exposes the system to man-in-the-middle attacks and data disclosure attacks. A man-in-the-middle attack occurs when an intruder captures packets between a client and server and modifies them before allowing the packets to be exchanged. Usually, the attacker will modify the information in the packets in an attempt to cause either the client or server to reveal sensitive information.Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000250-GPOS-00093
Solution
Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Security >> Require secure RPC communication to 'Enabled'.See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2025_V1R4_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows Server 2025 STIG v1r4
Category: ACCESS CONTROL
References: 800-53|AC-17(2), CAT|II, CCI|CCI-000068, CCI|CCI-001453, Rule-ID|SV-278115r1268222_rule, STIG-ID|WN25-CC-000370, Vuln-ID|V-278115
Plugin: Windows
Control ID: bc6c5d495717cccc6a1d68e1d42ed581b4db05223c4fcc7ea0ddc948ed74046e