STIGQter STIGQter: STIG Summary: Windows 2008 Member Server Security Technical Implementation Guide Version: 6 Release: 43 Benchmark Date: 26 Jul 2019: The system is not configured to meet the minimum requirement for session security for NTLM SSP based Servers.

DISA Rule

SV-29357r1_rule

Vulnerability Number

V-3666

Group Title

Session Security for NTLM SSP based Servers

Rule Version

3.089

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Network security: Minimum session security for NTLM SSP based (including secure RPC) servers” to “Require NTLMv2 session security”, ”Require 128-bit encryption (all options selected).

Check Contents

Analyze the system using the Security Configuration and Analysis snap-in.
Expand the Security Configuration and Analysis tree view.
Navigate to Local Policies -> Security Options.

If the value for “Network security: Minimum session security for NTLM SSP based (including secure RPC) servers” is not set to “Require NTLMv2 session security” and “Require 128-bit encryption”, then this is a finding.

Warning: Microsoft warns that setting these may prevent the client from communicating with legacy servers that do not support them.

The policy referenced configures the following registry value:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \System\CurrentControlSet\Control\Lsa\MSV1_0\

Value Name: NTLMMinServerSec

Value Type: REG_DWORD
Value: 0x20080000 (537395200)

Warning: “Require NTLMv2 session security” will prevent authentication, if the “Network security: LAN Manager Authentication level” is set to permit NTLM or LM authentication.

Documentable Explanation: If the required settings must be modified to support operation in a mixed Windows environment, then this should be documented with the IAO.

Vulnerability Number

V-3666

Documentable

True

Rule Version

3.089

Severity Override Guidance

Analyze the system using the Security Configuration and Analysis snap-in.
Expand the Security Configuration and Analysis tree view.
Navigate to Local Policies -> Security Options.

If the value for “Network security: Minimum session security for NTLM SSP based (including secure RPC) servers” is not set to “Require NTLMv2 session security” and “Require 128-bit encryption”, then this is a finding.

Warning: Microsoft warns that setting these may prevent the client from communicating with legacy servers that do not support them.

The policy referenced configures the following registry value:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \System\CurrentControlSet\Control\Lsa\MSV1_0\

Value Name: NTLMMinServerSec

Value Type: REG_DWORD
Value: 0x20080000 (537395200)

Warning: “Require NTLMv2 session security” will prevent authentication, if the “Network security: LAN Manager Authentication level” is set to permit NTLM or LM authentication.

Documentable Explanation: If the required settings must be modified to support operation in a mixed Windows environment, then this should be documented with the IAO.

Check Content Reference

M

Potential Impact

Microsoft warns that setting these may prevent
the server from communicating with legacy clients that do not
support them. “Require NTLMv2 session security” will prevent
authentication, if the “Network security: LAN Manager
authentication level” is set to permit NTLM or LM
authentication.

Responsibility

Information Assurance Officer

Target Key

1340

Comments