STIGQter: STIG Summary: Tanium 7.x Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

The permissions on the Tanium Server registry keys must be restricted to only the Tanium service account and the [Tanium Admins] group.

DISA Rule

SV-253854r997276_rule

Vulnerability Number

V-253854

Group Title

SRG-APP-000328

Rule Version

TANS-SV-000026

Severity

CAT II

CCI(s)

• CCI-002165 - Enforce organization-defined discretionary access control policies over defined subjects and objects.

Weight

10

Fix Recommendation

1. Access the Tanium Server.

2. Log on to the server with an account that has administrative privileges.

3. Run regedit as Administrator.

4. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.

5. Right-click "Tanium Server".

6. Select "Properties".

7. Click the "Security" tab.

8. Click the "Advanced" button.

9. Provide the [Tanium service account] with full permissions.

10. Provide the [Tanium Admins] group with full permissions.

11. Reduce permissions for any other accounts with full permissions.

12. Remove permissions for User accounts.

Check Contents

1. Access the Tanium Server.

2. Log on to the server with an account that has administrative privileges.

3. Run regedit as Administrator.

4. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.

5. Right-click "Tanium Server".

6. Select "Permissions".

7. Click the "Security" tab.

8. Click the "Advanced" button.

- Validate the [Tanium service account] has full permissions.
- Validate the [Tanium Admins] group has full permissions.
- Validate the SYSTEM account has full permissions.
- Validate the User accounts do not have any permissions.

If any other account has full permissions and/or the User account has any permissions, this is a finding.

Vulnerability Number

V-253854

Documentable

False

Rule Version

TANS-SV-000026

Severity Override Guidance

1. Access the Tanium Server.

2. Log on to the server with an account that has administrative privileges.

3. Run regedit as Administrator.

4. Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Wow6432Node >> Tanium >> Tanium Server.

5. Right-click "Tanium Server".

6. Select "Permissions".

7. Click the "Security" tab.

8. Click the "Advanced" button.

- Validate the [Tanium service account] has full permissions.
- Validate the [Tanium Admins] group has full permissions.
- Validate the SYSTEM account has full permissions.
- Validate the User accounts do not have any permissions.

If any other account has full permissions and/or the User account has any permissions, this is a finding.

Check Content Reference

M

Target Key

5476