WN19-00-000160 - Windows Server 2019 permissions for the Windows installation directory must conform to minimum requirements.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.

The default permissions are adequate when the Security Option 'Network access: Let Everyone permissions apply to anonymous users' is set to 'Disabled' (WN19-SO-000240).

Satisfies: SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123, SRG-OS-000312-GPOS-00124

Solution

Maintain the default file ACLs and configure the Security Option 'Network access: Let Everyone permissions apply to anonymous users' to 'Disabled' (WN19-SO-000240).

Default permissions:
Type - 'Allow' for all
Inherited from - 'None' for all

Principal - Access - Applies to

TrustedInstaller - Full control - This folder and subfolders
SYSTEM - Modify - This folder only
SYSTEM - Full control - Subfolders and files only
Administrators - Modify - This folder only
Administrators - Full control - Subfolders and files only
Users - Read & execute - This folder, subfolders, and files
CREATOR OWNER - Full control - Subfolders and files only
ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files
ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2019_V2R5_STIG.zip

Item Details

References: CAT|II, CCI|CCI-002165, Rule-ID|SV-205736r852434_rule, STIG-ID|WN19-00-000160, STIG-Legacy|SV-103111, STIG-Legacy|V-93023, Vuln-ID|V-205736

Plugin: Windows

Control ID: c66527a5162cbc9ed8e65d22e9ca24a05dcb11b08442211a026377734f6441dd