WN12-RG-000001 - Standard user accounts must only have Read permissions to the Winlogon registry key.

Information

Permissions on the Winlogon registry key must only allow privileged accounts to change registry values. If standard users have these permissions, there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.

Solution

Maintain permissions at least as restrictive as the defaults listed below for the 'WinLogon' registry key. It is recommended to not change the permissions from the defaults.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\

The following are the same for each permission listed:
Type - Allow
Inherited from - MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Applies to - This key and subkeys

Columns: Principal - Access
TrustedInstaller - Full Control
SYSTEM - Full Control
Administrators - Full Control
Users - Read
ALL APPLICATION PACKAGES - Read

Item Details

Audit Name: DISA Windows Server 2012 and 2012 R2 DC STIG v3r7

Category: ACCESS CONTROL

Plugin: Windows

Control ID: c43edbec22fac7ad17158440076576fd35b0f7ee52d7a5d22deca886f87322b1

Detections

Analytics

WN12-RG-000001 - Standard user accounts must only have Read permissions to the Winlogon registry key.

Information

Solution

See Also

Item Details