STIGQter STIGQter: STIG Summary: Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide Version: 2 Release: 19 Benchmark Date: 24 Jan 2020: The Deny log on through Remote Desktop Services user right on domain controllers must be configured to prevent unauthenticated access.

DISA Rule

SV-51148r1_rule

Vulnerability Number

V-26486

Group Title

Deny log on through Remote Desktop \ Terminal Services

Rule Version

WN12-UR-000021-DC

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Deny log on through Remote Desktop Services" to include the following:

Guests Group

Check Contents

Verify the effective setting in Local Group Policy Editor.
Run "gpedit.msc".

Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment.

If the following accounts or groups are not defined for the "Deny log on through Remote Desktop Services" user right, this is a finding:

Guests Group

Vulnerability Number

V-26486

Documentable

False

Rule Version

WN12-UR-000021-DC

Severity Override Guidance

Verify the effective setting in Local Group Policy Editor.
Run "gpedit.msc".

Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment.

If the following accounts or groups are not defined for the "Deny log on through Remote Desktop Services" user right, this is a finding:

Guests Group

Check Content Reference

M

Target Key

2350

Comments