'Require 128-bit encryption option for the Network security: Minimum session security for NTLM SSP based (including secure RPC) clients'ID: oval:org.secpod.oval:def:14595 | Date: (C)2013-08-13 (M)2023-07-14 |
Class: COMPLIANCE | Family: windows |
his policy setting determines which behaviors are allowed for applications using the NTLM Security Support Provider
(SSP). The SSP Interface (SSPI) is used by applications that need authentication services. The setting does not modify how the authentication
sequence works but instead require certain behaviors in applications that use the SSPI.
The possible values for the Network security: Minimum session security for NTLM SSP based (including secure RPC) clients setting are:
- Require message confidentiality. This option is only available in Windows XP and Windows Server 2003, the connection will fail if encryption
is not negotiated. Encryption converts data into a form that is not readable until decrypted.
- Require message integrity. This option is only available in Windows XP and Windows Server 2003, the connection will fail if message
integrity is not negotiated. The integrity of a message can be assessed through message signing. Message signing proves that the message has
not been tampered with; it attaches a cryptographic signature that identifies the sender and is a numeric representation of the contents of
the message.
- Require 128-bit encryption. The connection will fail if strong encryption (128-bit) is not negotiated.
Fix:
(1) GPO: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Network security: Minimum session security for NTLM SSP based (including secure RPC) clients
(2) REG: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0!NTLMMinClientSec
Platform: |
Microsoft Windows 7 |