STIGQter: STIG Summary: Microsoft Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 04 May 2021:

Event Viewer must be protected from unauthorized modification and deletion.

DISA Rule

SV-226134r569184_rule

Vulnerability Number

V-226134

Group Title

SRG-OS-000257-GPOS-00098

Rule Version

WN12-AU-000213

Severity

CAT II

CCI(s)

• CCI-001494 - The information system protects audit tools from unauthorized modification.
• CCI-001495 - The information system protects audit tools from unauthorized deletion.

Weight

10

Fix Recommendation

Ensure only TrustedInstaller has permissions to change or modify Event Viewer ("%SystemRoot%\SYSTEM32\Eventvwr.exe).

The default permissions below satisfy this requirement.
TrustedInstaller - Full Control
Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES - Read & Execute

Check Contents

Verify the permissions on Event Viewer only allow TrustedInstaller permissions to change or modify. If any groups or accounts other than TrustedInstaller have Full control or Modify, this is a finding.

Navigate to "%SystemRoot%\SYSTEM32".
View the permissions on "Eventvwr.exe".

The default permissions below satisfy this requirement.
TrustedInstaller - Full Control
Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES - Read & Execute

Vulnerability Number

V-226134

Documentable

False

Rule Version

WN12-AU-000213

Severity Override Guidance

Verify the permissions on Event Viewer only allow TrustedInstaller permissions to change or modify. If any groups or accounts other than TrustedInstaller have Full control or Modify, this is a finding.

Navigate to "%SystemRoot%\SYSTEM32".
View the permissions on "Eventvwr.exe".

The default permissions below satisfy this requirement.
TrustedInstaller - Full Control
Administrators, SYSTEM, Users, ALL APPLICATION PACKAGES - Read & Execute

Check Content Reference

M

Target Key

4217

Comments