Detections
Analytics
WN12-RG-000002 - Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key - compatability
Information
Permissions on the Active Setup\Installed Components registry key must only allow privileged accounts to add or change registry values. If standard user accounts have these permissions, there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.Solution
Maintain the default permissions of the following registry keys:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\ (64-bit systems only)
Users - Read
Administrators - Full Control
SYSTEM - Full Control
CREATOR OWNER - Full Control (Subkeys only)
ALL APPLICATION PACKAGES - Read
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_2012_and_2012_R2_MS_V3R7_STIG.zip
Item Details
Category: ACCESS CONTROL
References: 800-53|AC-6(10), CAT|I, CCI|CCI-002235, Rule-ID|SV-225445r877392_rule, STIG-ID|WN12-RG-000002, STIG-Legacy|SV-52956, STIG-Legacy|V-32282, Vuln-ID|V-225445
Plugin: Windows
Control ID: 2ac59c3ee7b8675b9a3ed15df01c845f9dad36c857e28dd58daeb2f7f1f6b188