[Forgot Password]
Login  Register Subscribe

23631

 
 

115038

 
 

95906

 
 

909

 
 

77986

 
 

109

Paid content will be excluded from the download.


Download | Alert*
OVAL

Specify the list of Users to 'Deny access to this computer from the network'

ID: oval:org.secpod.oval:def:36529Date: (C)2016-08-05   (M)2017-10-13
Class: COMPLIANCEFamily: windows




This policy setting prohibits users from connecting to a computer from across the network, which would allow users to access and potentially modify data remotely. In high security environments, there should be no need for remote users to access data on a computer. Instead, file sharing should be accomplished through the use of network servers. When configuring a user right in the SCM enter a comma delimited list of accounts. Accounts can be either local or located in Active Directory, they can be groups, users, or computers. Counter Measure: Assign the Deny access to this computer from the network user right to the following accounts: - ANONYMOUS LOGON - Built-in local Administrator account - Local Guest account - Built-in Support account - All service accounts An important exception to this list is any service accounts that are used to start services that need to connect to the computer over the network. For example, if you have configured a shared folder for Web servers to access and present content within that folder through a Web site, you may need to allow the account that runs IIS to log on to the server with the shared folder from the network. This user right is particularly effective when you need to configure servers and workstations on which sensitive information is handled because of regulatory compliance concerns. Potential Impact: If you configure the Deny access to this computer from the network user right for other groups, you could limit the abilities of users who are assigned to specific administrative roles in your environment. You should verify that delegated tasks will not be negatively affected. Fix: (1) GPO: Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny access to this computer from the network (2) REG: ### (3) WMI: root\rsop\computer RSOP_UserPrivilegeRight AccountList UserRight='SeDenyNetworkLogonRight' and precedence=1

Platform:
Microsoft Windows 10
Reference:
CCE-42621-3
CCE    1
CCE-42621-3
XCCDF    4
xccdf_org.secpod_benchmark_NIST_800_53_r4_Windows_10
xccdf_org.secpod_benchmark_PCI_3_2_Windows_10
xccdf_org.secpod_benchmark_NIST_800_171_R1_Windows_10
xccdf_org.secpod_benchmark_general_Windows_10
...

© 2013 SecPod Technologies