Detections
Analytics

800-53|CM-11(2)

Title

PROHIBIT INSTALLATION WITHOUT PRIVILEGED STATUS

Description

The information system prohibits user installation of software without explicit privileged status.

Supplemental

Privileged status can be obtained, for example, by serving in the role of system administrator.

Reference Item Details

Related: AC-6

Category: CONFIGURATION MANAGEMENT

Parent Title: USER-INSTALLED SOFTWARE

Family: CONFIGURATION MANAGEMENT

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1.9.1 (L1) Ensure 'Lock Encrypted Media Extensions' is set to 'Enabled'WindowsCIS Mozilla Firefox ESR GPO v1.0.0 L1
1.4.4 Ensure boot loader does not allow removable mediaUnixCIS Amazon Linux 2 STIG v2.0.1 STIG
1.4.4 Ensure boot loader does not allow removable mediaUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
1.6.1.10 Ensure system device files are labeled - device_tUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
1.6.1.10 Ensure system device files are labeled - unlabeled_tUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
1.6.1.10 Ensure system device files are labeled.UnixCIS Amazon Linux 2 STIG v2.0.1 STIG
1.53 EX19-MB-000194WindowsCIS Microsoft Exchange 2019 Mailbox Server STIG v1.0.0 CAT II
1.56 EX19-ED-000195WindowsCIS Microsoft Exchange 2019 Edge Server STIG v1.0.0 CAT II
1.64 MADB-10-007800MySQLDBCIS MariaDB Enterprise 10.x STIG v1.1.0 CAT II MySQLDB
1.134 WN16-CC-000450WindowsCIS Microsoft Windows Server 2016 STIG v4.0.0 MS CAT II
1.134 WN16-CC-000450WindowsCIS Microsoft Windows Server 2016 STIG v4.0.0 DC CAT II
1.135 WN16-CC-000460WindowsCIS Microsoft Windows Server 2016 STIG v4.0.0 DC CAT I
1.135 WN16-CC-000460WindowsCIS Microsoft Windows Server 2016 STIG v4.0.0 MS CAT I
1.135 WN19-CC-000420WindowsCIS Microsoft Windows Server 2019 STIG v4.0.0 MS CAT II
1.135 WN19-CC-000420WindowsCIS Microsoft Windows Server 2019 STIG v4.0.0 DC CAT II
1.135 WN22-CC-000420WindowsCIS Microsoft Windows Server 2022 STIG v3.0.0 DC CAT II
1.135 WN22-CC-000420WindowsCIS Microsoft Windows Server 2022 STIG v3.0.0 MS CAT II
1.136 WN19-CC-000430WindowsCIS Microsoft Windows Server 2019 STIG v4.0.0 DC CAT I
1.136 WN19-CC-000430WindowsCIS Microsoft Windows Server 2019 STIG v4.0.0 MS CAT I
1.136 WN22-CC-000430WindowsCIS Microsoft Windows Server 2022 STIG v3.0.0 DC CAT I
1.136 WN22-CC-000430WindowsCIS Microsoft Windows Server 2022 STIG v3.0.0 MS CAT I
1.149 APPL-26-005080UnixCIS Apple macOS 26 Tahoe STIG v1.0.0 CAT II
1.150 APPL-14-005080UnixCIS Apple macOS 14 Sonoma STIG v1.0.0 CAT II
1.164 WN10-CC-000310WindowsCIS Microsoft Windows 10 STIG v1.0.0 CAT II
1.165 WN10-CC-000315WindowsCIS Microsoft Windows 10 STIG v1.0.0 CAT I
1.245 RHEL-10-600170UnixCIS Red Hat Enterprise Linux 10 STIG v1.0.0 CAT II
2.2.21 Ensure the TFTP server has not been installedUnixCIS Amazon Linux 2 STIG v2.0.1 STIG
2.2.21 Ensure the TFTP server has not been installed - TFTP server package installed if not required for operational support.UnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
3.029 - Print driver installation privilege is not restricted to administrators.WindowsDISA Windows Vista STIG v6r41
4.2.1.6 Ensure remote rsyslog messages are only accepted on designated log hosts.UnixCIS Amazon Linux 2 STIG v2.0.1 L1 Server
4.2.1.6 Ensure remote rsyslog messages are only accepted on designated log hosts.UnixCIS Amazon Linux 2 STIG v2.0.1 STIG
4.2.1.6 Ensure remote rsyslog messages are only accepted on designated log hosts.UnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
5.3.30 Ensure SSH does not permit GSSAPIUnixCIS Amazon Linux 2 STIG v2.0.1 STIG
5.3.30 Ensure SSH does not permit GSSAPI - GSSAPI authentication unless needed.UnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
5.3.31 Ensure SSH does not permit Kerberos authenticationUnixCIS Amazon Linux 2 STIG v2.0.1 STIG
5.3.31 Ensure SSH does not permit Kerberos authenticationUnixCIS Red Hat Enterprise Linux 7 STIG v2.0.0 STIG
5.5.9 Ensure local interactive user accounts umask is 077UnixCIS Amazon Linux 2 STIG v2.0.1 STIG
5.060 - Media Player must be configured to prevent automatic checking for updates.WindowsDISA Windows Vista STIG v6r41
5.128 - Search Companion prevented from automatically downloading content updates.WindowsDISA Windows Vista STIG v6r41
5.131 - Windows is prevented from using Windows Update to search for drivers.WindowsDISA Windows Vista STIG v6r41
5.211 - Driver Install - Device Driver Search PromptWindowsDISA Windows Vista STIG v6r41
5.242 - Windows Installer - User ControlWindowsDISA Windows Vista STIG v6r41
5.243 - Windows Installer - Vendor Signed UpdatesWindowsDISA Windows Vista STIG v6r41
5.250 - Unsigned gadgets must not be installed. - TurnOffUnsignedGadgetsWindowsDISA Windows Vista STIG v6r41
5.251 - The More Gadgets link must be disabled.WindowsDISA Windows Vista STIG v6r41
5.252 - User-installed gadgets must be turned off.WindowsDISA Windows Vista STIG v6r41
18.9.18.1 Ensure 'Turn off desktop gadgets' is set to 'Enabled'WindowsCIS Windows 7 Workstation Level 1 + Bitlocker v3.2.0
18.9.18.1 Ensure 'Turn off desktop gadgets' is set to 'Enabled'WindowsCIS Windows 7 Workstation Level 1 v3.2.0
18.9.18.2 Ensure 'Turn Off user-installed desktop gadgets' is set to 'Enabled'WindowsCIS Windows 7 Workstation Level 1 v3.2.0
18.9.18.2 Ensure 'Turn Off user-installed desktop gadgets' is set to 'Enabled'WindowsCIS Windows 7 Workstation Level 1 + Bitlocker v3.2.0