@mitre/hdf-fixtures 3.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +132 -0
- package/baseline/win2022-stig.json +671 -0
- package/dist/index.d.ts +46 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +39 -0
- package/dist/index.js.map +1 -0
- package/inspec/container-scan.json +32281 -0
- package/inspec/three-layer-overlay.json +47551 -0
- package/inspec/three-layer-rhel7.json +47551 -0
- package/inspec/ubi9-scan.json +1 -0
- package/inspec/wrapper.json +1 -0
- package/package.json +39 -0
- package/results/inspec-multilayered.json +94427 -0
- package/results/minimal.json +44 -0
|
@@ -0,0 +1,671 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "microsoft-windows-server-2022-stig-baseline",
|
|
3
|
+
"title": "Microsoft Windows Server 2022 Security Technical Implementation Guide",
|
|
4
|
+
"version": "2.7.0",
|
|
5
|
+
"maintainer": "MITRE SAF Team",
|
|
6
|
+
"copyright": "MITRE",
|
|
7
|
+
"license": "Apache-2.0",
|
|
8
|
+
"summary": "InSpec profile aligned to STIG Guidance for Microsoft Windows Server",
|
|
9
|
+
"supports": [],
|
|
10
|
+
"groups": [],
|
|
11
|
+
"requirements": [
|
|
12
|
+
{
|
|
13
|
+
"tags": {
|
|
14
|
+
"check_id": "C-57723r848528_chk",
|
|
15
|
+
"severity": "medium",
|
|
16
|
+
"gid": "V-254238",
|
|
17
|
+
"rid": "SV-254238r991589_rule",
|
|
18
|
+
"stig_id": "WN22-00-000010",
|
|
19
|
+
"gtitle": "SRG-OS-000480-GPOS-00227",
|
|
20
|
+
"fix_id": "F-57674r848529_fix",
|
|
21
|
+
"cci": [
|
|
22
|
+
"CCI-000366"
|
|
23
|
+
],
|
|
24
|
+
"nist": [
|
|
25
|
+
"CM-6 b"
|
|
26
|
+
],
|
|
27
|
+
"documentable": true
|
|
28
|
+
},
|
|
29
|
+
"descriptions": [
|
|
30
|
+
{
|
|
31
|
+
"label": "default",
|
|
32
|
+
"data": "Using a privileged account to perform routine functions makes the computer vulnerable to malicious software inadvertently introduced during a session that has been granted full privileges."
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"label": "check",
|
|
36
|
+
"data": "Verify each user with administrative privileges has been assigned a unique administrative account separate from their standard user account. \n\nIf users with administrative privileges do not have separate accounts for administrative functions and standard user functions, this is a finding."
|
|
37
|
+
},
|
|
38
|
+
{
|
|
39
|
+
"label": "fix",
|
|
40
|
+
"data": "Ensure each user with administrative privileges has a separate account for user duties and one for privileged duties."
|
|
41
|
+
}
|
|
42
|
+
],
|
|
43
|
+
"id": "SV-254238",
|
|
44
|
+
"title": "Windows Server 2022 users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks.",
|
|
45
|
+
"impact": 0.5
|
|
46
|
+
},
|
|
47
|
+
{
|
|
48
|
+
"tags": {
|
|
49
|
+
"check_id": "C-57725r848534_chk",
|
|
50
|
+
"severity": "high",
|
|
51
|
+
"gid": "V-254240",
|
|
52
|
+
"rid": "SV-254240r991589_rule",
|
|
53
|
+
"stig_id": "WN22-00-000030",
|
|
54
|
+
"gtitle": "SRG-OS-000480-GPOS-00227",
|
|
55
|
+
"fix_id": "F-57676r848535_fix",
|
|
56
|
+
"satisfies": [
|
|
57
|
+
"SRG-OS-000480-GPOS-00227",
|
|
58
|
+
"SRG-OS-000205-GPOS-00083"
|
|
59
|
+
],
|
|
60
|
+
"cci": [
|
|
61
|
+
"CCI-000366",
|
|
62
|
+
"CCI-001312"
|
|
63
|
+
],
|
|
64
|
+
"nist": [
|
|
65
|
+
"CM-6 b",
|
|
66
|
+
"SI-11 a"
|
|
67
|
+
],
|
|
68
|
+
"documentable": true
|
|
69
|
+
},
|
|
70
|
+
"descriptions": [
|
|
71
|
+
{
|
|
72
|
+
"label": "default",
|
|
73
|
+
"data": "Using applications that access the internet or have potential internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running as a privileged user, the entire system could be compromised. Web browsers and email are common attack vectors for introducing malicious code and must not be run with an administrative account.\n\nSince administrative accounts may generally change or work around technical restrictions for running a web browser or other applications, it is essential that policy require administrative accounts to not access the internet or use applications such as email.\n\nThe policy must define specific exceptions for local service administration. These exceptions may include HTTP(S)-based tools that are used for the administration of the local system, services, or attached devices.\n\nWhitelisting can be used to enforce the policy to ensure compliance.\n\n"
|
|
74
|
+
},
|
|
75
|
+
{
|
|
76
|
+
"label": "check",
|
|
77
|
+
"data": "Determine whether organization policy, at a minimum, prohibits administrative accounts from using applications that access the internet, such as web browsers, or with potential internet sources, such as email, except as necessary for local service administration.\n\nIf it does not, this is a finding.\n\nThe organization may use technical means such as whitelisting to prevent the use of browsers and mail applications to enforce this requirement."
|
|
78
|
+
},
|
|
79
|
+
{
|
|
80
|
+
"label": "fix",
|
|
81
|
+
"data": "Establish a policy, at minimum, to prohibit administrative accounts from using applications that access the internet, such as web browsers, or with potential internet sources, such as email. Ensure the policy is enforced.\n\nThe organization may use technical means such as whitelisting to prevent the use of browsers and mail applications to enforce this requirement."
|
|
82
|
+
}
|
|
83
|
+
],
|
|
84
|
+
"id": "SV-254240",
|
|
85
|
+
"title": "Windows Server 2022 administrative accounts must not be used with applications that access the internet, such as web browsers, or with potential internet sources, such as email.",
|
|
86
|
+
"impact": 0.7
|
|
87
|
+
},
|
|
88
|
+
{
|
|
89
|
+
"tags": {
|
|
90
|
+
"check_id": "C-57728r848543_chk",
|
|
91
|
+
"severity": "medium",
|
|
92
|
+
"gid": "V-254243",
|
|
93
|
+
"rid": "SV-254243r991589_rule",
|
|
94
|
+
"stig_id": "WN22-00-000060",
|
|
95
|
+
"gtitle": "SRG-OS-000480-GPOS-00227",
|
|
96
|
+
"fix_id": "F-57679r848544_fix",
|
|
97
|
+
"cci": [
|
|
98
|
+
"CCI-000366"
|
|
99
|
+
],
|
|
100
|
+
"nist": [
|
|
101
|
+
"CM-6 b"
|
|
102
|
+
],
|
|
103
|
+
"documentable": true
|
|
104
|
+
},
|
|
105
|
+
"descriptions": [
|
|
106
|
+
{
|
|
107
|
+
"label": "default",
|
|
108
|
+
"data": "Setting application account passwords to expire may cause applications to stop functioning. However, not changing them on a regular basis exposes them to attack. If managed service accounts are used, this alleviates the need to manually change application account passwords."
|
|
109
|
+
},
|
|
110
|
+
{
|
|
111
|
+
"label": "fix",
|
|
112
|
+
"data": "Change passwords for manually managed application/service accounts at least annually or when an administrator with knowledge of the password leaves the organization.\n\nIt is recommended that system-managed service accounts be used whenever possible."
|
|
113
|
+
}
|
|
114
|
+
],
|
|
115
|
+
"id": "SV-254243",
|
|
116
|
+
"title": "Windows Server 2022 manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.",
|
|
117
|
+
"impact": 0.5
|
|
118
|
+
},
|
|
119
|
+
{
|
|
120
|
+
"tags": {
|
|
121
|
+
"check_id": "C-57745r848594_chk",
|
|
122
|
+
"severity": "medium",
|
|
123
|
+
"gid": "V-254260",
|
|
124
|
+
"rid": "SV-254260r1137695_rule",
|
|
125
|
+
"stig_id": "WN22-00-000230",
|
|
126
|
+
"gtitle": "SRG-OS-000138-GPOS-00069",
|
|
127
|
+
"fix_id": "F-57696r848595_fix",
|
|
128
|
+
"cci": [
|
|
129
|
+
"CCI-001090"
|
|
130
|
+
],
|
|
131
|
+
"nist": [
|
|
132
|
+
"SC-4"
|
|
133
|
+
],
|
|
134
|
+
"documentable": true
|
|
135
|
+
},
|
|
136
|
+
"descriptions": [
|
|
137
|
+
{
|
|
138
|
+
"label": "default",
|
|
139
|
+
"data": "Shares on a system provide network access. To prevent exposing sensitive information, where shares are necessary, permissions must be reconfigured to give the minimum access to accounts that require it."
|
|
140
|
+
},
|
|
141
|
+
{
|
|
142
|
+
"label": "check",
|
|
143
|
+
"data": "If only system-created shares such as \"ADMIN$\", \"C$\", and \"IPC$\" exist on the system, this is NA. (System-created shares will display a message that it has been shared for administrative purposes when \"Properties\" is selected.)\n\nRun \"Computer Management\".\n\nNavigate to System Tools >> Shared Folders >> Shares.\n\nRight-click any nonsystem-created shares.\n\nSelect \"Properties\".\n\nSelect the \"Share Permissions\" tab.\n\nIf the file shares have not been configured to restrict permissions to the specific groups or accounts that require access, this is a finding.\n\nSelect the \"Security\" tab.\n\nIf the permissions have not been configured to restrict permissions to the specific groups or accounts that require access, this is a finding."
|
|
144
|
+
},
|
|
145
|
+
{
|
|
146
|
+
"label": "fix",
|
|
147
|
+
"data": "If a nonsystem-created share is required on a system, configure the share and NTFS permissions to limit access to the specific groups or accounts that require it.\n\nRemove any unnecessary nonsystem-created shares."
|
|
148
|
+
}
|
|
149
|
+
],
|
|
150
|
+
"id": "SV-254260",
|
|
151
|
+
"title": "Windows Server 2022 nonsystem-created file shares must limit access to groups that require it.",
|
|
152
|
+
"impact": 0.5
|
|
153
|
+
},
|
|
154
|
+
{
|
|
155
|
+
"tags": {
|
|
156
|
+
"check_id": "C-57755r848624_chk",
|
|
157
|
+
"severity": "medium",
|
|
158
|
+
"gid": "V-254270",
|
|
159
|
+
"rid": "SV-254270r958480_rule",
|
|
160
|
+
"stig_id": "WN22-00-000330",
|
|
161
|
+
"gtitle": "SRG-OS-000096-GPOS-00050",
|
|
162
|
+
"fix_id": "F-57706r848625_fix",
|
|
163
|
+
"cci": [
|
|
164
|
+
"CCI-000382"
|
|
165
|
+
],
|
|
166
|
+
"nist": [
|
|
167
|
+
"CM-7 b"
|
|
168
|
+
],
|
|
169
|
+
"documentable": true
|
|
170
|
+
},
|
|
171
|
+
"descriptions": [
|
|
172
|
+
{
|
|
173
|
+
"label": "default",
|
|
174
|
+
"data": "Unnecessary services increase the attack surface of a system. Some of these services may not support required levels of authentication or encryption."
|
|
175
|
+
},
|
|
176
|
+
{
|
|
177
|
+
"label": "check",
|
|
178
|
+
"data": "If the server has the role of an FTP server, this is NA.\n\nOpen \"PowerShell\".\n\nEnter \"Get-WindowsFeature | Where Name -eq Web-Ftp-Service\".\n\nIf \"Installed State\" is \"Installed\", this is a finding.\n\nAn Installed State of \"Available\" or \"Removed\" is not a finding.\n\nIf the system has the role of an FTP server, this must be documented with the Information System Security Officer (ISSO)."
|
|
179
|
+
},
|
|
180
|
+
{
|
|
181
|
+
"label": "fix",
|
|
182
|
+
"data": "Uninstall the \"FTP Server\" role.\n\nStart \"Server Manager\".\n\nSelect the server with the role.\n\nScroll down to \"ROLES AND FEATURES\" in the right pane.\n\nSelect \"Remove Roles and Features\" from the drop-down \"TASKS\" list.\n\nSelect the appropriate server on the \"Server Selection\" page and click \"Next\".\n\nDeselect \"FTP Server\" under \"Web Server (IIS)\" on the \"Roles\" page.\n\nClick \"Next\" and \"Remove\" as prompted."
|
|
183
|
+
}
|
|
184
|
+
],
|
|
185
|
+
"id": "SV-254270",
|
|
186
|
+
"title": "Windows Server 2022 must not have the Microsoft FTP service installed unless required by the organization.",
|
|
187
|
+
"impact": 0.5
|
|
188
|
+
},
|
|
189
|
+
{
|
|
190
|
+
"tags": {
|
|
191
|
+
"check_id": "C-57765r848654_chk",
|
|
192
|
+
"severity": "medium",
|
|
193
|
+
"gid": "V-254280",
|
|
194
|
+
"rid": "SV-254280r991589_rule",
|
|
195
|
+
"stig_id": "WN22-00-000430",
|
|
196
|
+
"gtitle": "SRG-OS-000480-GPOS-00227",
|
|
197
|
+
"fix_id": "F-57716r848655_fix",
|
|
198
|
+
"cci": [
|
|
199
|
+
"CCI-000366"
|
|
200
|
+
],
|
|
201
|
+
"nist": [
|
|
202
|
+
"CM-6 b"
|
|
203
|
+
],
|
|
204
|
+
"documentable": true
|
|
205
|
+
},
|
|
206
|
+
"descriptions": [
|
|
207
|
+
{
|
|
208
|
+
"label": "default",
|
|
209
|
+
"data": "The FTP service allows remote users to access shared files and directories that could provide access to system resources and compromise the system, especially if the user can gain access to the root directory of the boot drive."
|
|
210
|
+
},
|
|
211
|
+
{
|
|
212
|
+
"label": "check",
|
|
213
|
+
"data": "If FTP is not installed on the system, this is NA.\n\nOpen \"Internet Information Services (IIS) Manager\".\n\nSelect \"Sites\" under the server name.\n\nFor any sites with a Binding that lists FTP, right-click the site and select \"Explore\".\n\nIf the site is not defined to a specific folder for shared FTP resources, this is a finding.\n\nIf the site includes any system areas such as root of the drive, Program Files, or Windows directories, this is a finding."
|
|
214
|
+
},
|
|
215
|
+
{
|
|
216
|
+
"label": "fix",
|
|
217
|
+
"data": "Configure the FTP sites to allow access only to specific FTP shared resources. Do not allow access to other areas of the system."
|
|
218
|
+
}
|
|
219
|
+
],
|
|
220
|
+
"id": "SV-254280",
|
|
221
|
+
"title": "Windows Server 2022 FTP servers must be configured to prevent access to the system drive.",
|
|
222
|
+
"impact": 0.5
|
|
223
|
+
},
|
|
224
|
+
{
|
|
225
|
+
"tags": {
|
|
226
|
+
"check_id": "C-57775r848684_chk",
|
|
227
|
+
"severity": "medium",
|
|
228
|
+
"gid": "V-254290",
|
|
229
|
+
"rid": "SV-254290r1051092_rule",
|
|
230
|
+
"stig_id": "WN22-AC-000060",
|
|
231
|
+
"gtitle": "SRG-OS-000075-GPOS-00043",
|
|
232
|
+
"fix_id": "F-57726r848685_fix",
|
|
233
|
+
"cci": [
|
|
234
|
+
"CCI-004066",
|
|
235
|
+
"CCI-000198"
|
|
236
|
+
],
|
|
237
|
+
"nist": [
|
|
238
|
+
"IA-5 (1) (h)",
|
|
239
|
+
"IA-5 (1) (d)"
|
|
240
|
+
],
|
|
241
|
+
"documentable": true
|
|
242
|
+
},
|
|
243
|
+
"descriptions": [
|
|
244
|
+
{
|
|
245
|
+
"label": "default",
|
|
246
|
+
"data": "Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database. This enables users to effectively negate the purpose of mandating periodic password changes."
|
|
247
|
+
},
|
|
248
|
+
{
|
|
249
|
+
"label": "check",
|
|
250
|
+
"data": "Verify the effective setting in Local Group Policy Editor.\n\nRun \"gpedit.msc\".\n\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy.\n\nIf the value for the \"Minimum password age\" is set to \"0\" days (\"Password can be changed immediately\"), this is a finding.\n\nFor server core installations, run the following command:\n\nSecedit /Export /Areas SecurityPolicy /CFG C:\\\\Path\\\\FileName.Txt\n\nIf \"MinimumPasswordAge\" equals \"0\" in the file, this is a finding."
|
|
251
|
+
},
|
|
252
|
+
{
|
|
253
|
+
"label": "fix",
|
|
254
|
+
"data": "Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> Minimum password age to at least \"1\" day."
|
|
255
|
+
}
|
|
256
|
+
],
|
|
257
|
+
"id": "SV-254290",
|
|
258
|
+
"title": "Windows Server 2022 minimum password age must be configured to at least one day.",
|
|
259
|
+
"impact": 0.5
|
|
260
|
+
},
|
|
261
|
+
{
|
|
262
|
+
"tags": {
|
|
263
|
+
"check_id": "C-57785r848714_chk",
|
|
264
|
+
"severity": "medium",
|
|
265
|
+
"gid": "V-254300",
|
|
266
|
+
"rid": "SV-254300r991578_rule",
|
|
267
|
+
"stig_id": "WN22-AU-000070",
|
|
268
|
+
"gtitle": "SRG-OS-000470-GPOS-00214",
|
|
269
|
+
"fix_id": "F-57736r848715_fix",
|
|
270
|
+
"cci": [
|
|
271
|
+
"CCI-000172"
|
|
272
|
+
],
|
|
273
|
+
"nist": [
|
|
274
|
+
"AU-12 c"
|
|
275
|
+
],
|
|
276
|
+
"documentable": true
|
|
277
|
+
},
|
|
278
|
+
"descriptions": [
|
|
279
|
+
{
|
|
280
|
+
"label": "default",
|
|
281
|
+
"data": "Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\n\nCredential Validation records events related to validation tests on credentials for a user account logon."
|
|
282
|
+
},
|
|
283
|
+
{
|
|
284
|
+
"label": "check",
|
|
285
|
+
"data": "Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN22-SO-000050) for the detailed auditing subcategories to be effective. \n\nUse the \"AuditPol\" tool to review the current Audit Policy configuration:\n\nOpen \"PowerShell\" or a \"Command Prompt\" with elevated privileges (\"Run as administrator\").\n\nEnter \"AuditPol /get /category:*\"\n\nCompare the \"AuditPol\" settings with the following:\n\nIf the system does not audit the following, this is a finding.\n\nAccount Logon >> Credential Validation - Success"
|
|
286
|
+
},
|
|
287
|
+
{
|
|
288
|
+
"label": "fix",
|
|
289
|
+
"data": "Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> Audit Credential Validation with \"Success\" selected."
|
|
290
|
+
}
|
|
291
|
+
],
|
|
292
|
+
"id": "SV-254300",
|
|
293
|
+
"title": "Windows Server 2022 must be configured to audit Account Logon - Credential Validation successes.",
|
|
294
|
+
"impact": 0.5
|
|
295
|
+
},
|
|
296
|
+
{
|
|
297
|
+
"tags": {
|
|
298
|
+
"check_id": "C-57795r848744_chk",
|
|
299
|
+
"severity": "medium",
|
|
300
|
+
"gid": "V-254310",
|
|
301
|
+
"rid": "SV-254310r991578_rule",
|
|
302
|
+
"stig_id": "WN22-AU-000170",
|
|
303
|
+
"gtitle": "SRG-OS-000470-GPOS-00214",
|
|
304
|
+
"fix_id": "F-57746r848745_fix",
|
|
305
|
+
"cci": [
|
|
306
|
+
"CCI-000172"
|
|
307
|
+
],
|
|
308
|
+
"nist": [
|
|
309
|
+
"AU-12 c"
|
|
310
|
+
],
|
|
311
|
+
"documentable": true
|
|
312
|
+
},
|
|
313
|
+
"descriptions": [
|
|
314
|
+
{
|
|
315
|
+
"label": "default",
|
|
316
|
+
"data": "check', 'Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN22-SO-000050) for the detailed auditing subcategories to be effective. \n\nUse the \"AuditPol\" tool to review the current Audit Policy configuration:\n\nOpen \"PowerShell\" or a \"Command Prompt\" with elevated privileges (\"Run as administrator\").\n\nEnter \"AuditPol /get /category:*\"\n\nCompare the \"AuditPol\" settings with the following:\n\nIf the system does not audit the following, this is a finding.\n\nLogon/Logoff >> Group Membership - Success"
|
|
317
|
+
},
|
|
318
|
+
{
|
|
319
|
+
"label": "check",
|
|
320
|
+
"data": "Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN22-SO-000050) for the detailed auditing subcategories to be effective. \n\nUse the \"AuditPol\" tool to review the current Audit Policy configuration:\n\nOpen \"PowerShell\" or a \"Command Prompt\" with elevated privileges (\"Run as administrator\").\n\nEnter \"AuditPol /get /category:*\"\n\nCompare the \"AuditPol\" settings with the following:\n\nIf the system does not audit the following, this is a finding.\n\nLogon/Logoff >> Group Membership - Success"
|
|
321
|
+
},
|
|
322
|
+
{
|
|
323
|
+
"label": "fix",
|
|
324
|
+
"data": "Configure the policy value for Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> Audit Group Membership with \"Success\" selected."
|
|
325
|
+
}
|
|
326
|
+
],
|
|
327
|
+
"id": "SV-254310",
|
|
328
|
+
"title": "Windows Server 2022 must be configured to audit Logon/Logoff - Group Membership successes.",
|
|
329
|
+
"impact": 0.5
|
|
330
|
+
},
|
|
331
|
+
{
|
|
332
|
+
"tags": {
|
|
333
|
+
"check_id": "C-57805r848774_chk",
|
|
334
|
+
"severity": "medium",
|
|
335
|
+
"gid": "V-254320",
|
|
336
|
+
"rid": "SV-254320r958732_rule",
|
|
337
|
+
"stig_id": "WN22-AU-000270",
|
|
338
|
+
"gtitle": "SRG-OS-000327-GPOS-00127",
|
|
339
|
+
"fix_id": "F-57756r848775_fix",
|
|
340
|
+
"satisfies": [
|
|
341
|
+
"SRG-OS-000327-GPOS-00127",
|
|
342
|
+
"SRG-OS-000458-GPOS-00203",
|
|
343
|
+
"SRG-OS-000463-GPOS-00207",
|
|
344
|
+
"SRG-OS-000468-GPOS-00212"
|
|
345
|
+
],
|
|
346
|
+
"cci": [
|
|
347
|
+
"CCI-000172",
|
|
348
|
+
"CCI-002234"
|
|
349
|
+
],
|
|
350
|
+
"nist": [
|
|
351
|
+
"AU-12 c",
|
|
352
|
+
"AC-6 (9)"
|
|
353
|
+
],
|
|
354
|
+
"documentable": true
|
|
355
|
+
},
|
|
356
|
+
"descriptions": [
|
|
357
|
+
{
|
|
358
|
+
"label": "default",
|
|
359
|
+
"data": "Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior.\n\nAudit Policy Change records events related to changes in audit policy.\n\n"
|
|
360
|
+
},
|
|
361
|
+
{
|
|
362
|
+
"label": "check",
|
|
363
|
+
"data": "Security Option \"Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\" must be set to \"Enabled\" (WN22-SO-000050) for the detailed auditing subcategories to be effective. \n\nUse the \"AuditPol\" tool to review the current Audit Policy configuration:\n\nOpen \"PowerShell\" or a \"Command Prompt\" with elevated privileges (\"Run as administrator\").\n\nEnter \"AuditPol /get /category:*\"\n\nCompare the \"AuditPol\" settings with the following:\n\nIf the system does not audit the following, this is a finding.\n\nPolicy Change >> Audit Audit Policy Change - Failure"
|
|
364
|
+
},
|
|
365
|
+
{
|
|
366
|
+
"label": "fix",
|
|
367
|
+
"data": "Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Policy Change >> Audit Audit Policy Change with \"Failure\" selected."
|
|
368
|
+
}
|
|
369
|
+
],
|
|
370
|
+
"id": "SV-254320",
|
|
371
|
+
"title": "Windows Server 2022 must be configured to audit Policy Change - Audit Policy Change failures.",
|
|
372
|
+
"impact": 0.5
|
|
373
|
+
},
|
|
374
|
+
{
|
|
375
|
+
"tags": {
|
|
376
|
+
"check_id": "C-57835r848864_chk",
|
|
377
|
+
"severity": "medium",
|
|
378
|
+
"gid": "V-254350",
|
|
379
|
+
"rid": "SV-254350r991589_rule",
|
|
380
|
+
"stig_id": "WN22-CC-000190",
|
|
381
|
+
"gtitle": "SRG-OS-000480-GPOS-00227",
|
|
382
|
+
"fix_id": "F-57786r848865_fix",
|
|
383
|
+
"cci": [
|
|
384
|
+
"CCI-000366"
|
|
385
|
+
],
|
|
386
|
+
"nist": [
|
|
387
|
+
"CM-6 b"
|
|
388
|
+
],
|
|
389
|
+
"documentable": true
|
|
390
|
+
},
|
|
391
|
+
"descriptions": [
|
|
392
|
+
{
|
|
393
|
+
"label": "default",
|
|
394
|
+
"data": "A system that does not require authentication when resuming from sleep may provide access to unauthorized users. Authentication must always be required when accessing a system. This setting ensures users are prompted for a password when the system wakes from sleep (plugged in)."
|
|
395
|
+
},
|
|
396
|
+
{
|
|
397
|
+
"label": "check",
|
|
398
|
+
"data": "If the following registry value does not exist or is not configured as specified, this is a finding:\n\nRegistry Hive: HKEY_LOCAL_MACHINE\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Power\\\\PowerSettings\\\\0e796bdb-100d-47d6-a2d5-f7d2daa51f51\\\\\n\nValue Name: ACSettingIndex\n\nType: REG_DWORD\nValue: 0x00000001 (1)"
|
|
399
|
+
},
|
|
400
|
+
{
|
|
401
|
+
"label": "fix",
|
|
402
|
+
"data": "Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Power Management >> Sleep Settings >> Require a password when a computer wakes (plugged in) to \"Enabled\"."
|
|
403
|
+
}
|
|
404
|
+
],
|
|
405
|
+
"id": "SV-254350",
|
|
406
|
+
"title": "Windows Server 2022 users must be prompted to authenticate when the system wakes from sleep (plugged in).",
|
|
407
|
+
"impact": 0.5
|
|
408
|
+
},
|
|
409
|
+
{
|
|
410
|
+
"tags": {
|
|
411
|
+
"check_id": "C-57865r848954_chk",
|
|
412
|
+
"severity": "medium",
|
|
413
|
+
"gid": "V-254380",
|
|
414
|
+
"rid": "SV-254380r958510_rule",
|
|
415
|
+
"stig_id": "WN22-CC-000490",
|
|
416
|
+
"gtitle": "SRG-OS-000125-GPOS-00065",
|
|
417
|
+
"fix_id": "F-57816r848955_fix",
|
|
418
|
+
"cci": [
|
|
419
|
+
"CCI-000877"
|
|
420
|
+
],
|
|
421
|
+
"nist": [
|
|
422
|
+
"MA-4 c"
|
|
423
|
+
],
|
|
424
|
+
"documentable": true
|
|
425
|
+
},
|
|
426
|
+
"descriptions": [
|
|
427
|
+
{
|
|
428
|
+
"label": "default",
|
|
429
|
+
"data": "Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks. Disallowing Digest authentication will reduce this potential."
|
|
430
|
+
},
|
|
431
|
+
{
|
|
432
|
+
"label": "check",
|
|
433
|
+
"data": "If the following registry value does not exist or is not configured as specified, this is a finding:\n\nRegistry Hive: HKEY_LOCAL_MACHINE\nRegistry Path: \\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\WinRM\\\\Client\\\\\n\nValue Name: AllowDigest\n\nType: REG_DWORD\nValue: 0x00000000 (0)"
|
|
434
|
+
},
|
|
435
|
+
{
|
|
436
|
+
"label": "fix",
|
|
437
|
+
"data": "Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> Disallow Digest authentication to \"Enabled\"."
|
|
438
|
+
}
|
|
439
|
+
],
|
|
440
|
+
"id": "SV-254380",
|
|
441
|
+
"title": "Windows Server 2022 Windows Remote Management (WinRM) client must not use Digest authentication.",
|
|
442
|
+
"impact": 0.5
|
|
443
|
+
},
|
|
444
|
+
{
|
|
445
|
+
"tags": {
|
|
446
|
+
"check_id": "C-57885r849014_chk",
|
|
447
|
+
"severity": "low",
|
|
448
|
+
"gid": "V-254400",
|
|
449
|
+
"rid": "SV-254400r970703_rule",
|
|
450
|
+
"stig_id": "WN22-DC-000160",
|
|
451
|
+
"gtitle": "SRG-OS-000163-GPOS-00072",
|
|
452
|
+
"fix_id": "F-57836r849015_fix",
|
|
453
|
+
"satisfies": [
|
|
454
|
+
"SRG-OS-000163-GPOS-00072",
|
|
455
|
+
"SRG-OS-000279-GPOS-00109"
|
|
456
|
+
],
|
|
457
|
+
"cci": [
|
|
458
|
+
"CCI-001133",
|
|
459
|
+
"CCI-002361"
|
|
460
|
+
],
|
|
461
|
+
"nist": [
|
|
462
|
+
"SC-10",
|
|
463
|
+
"AC-12"
|
|
464
|
+
],
|
|
465
|
+
"documentable": true
|
|
466
|
+
},
|
|
467
|
+
"descriptions": [
|
|
468
|
+
{
|
|
469
|
+
"label": "default",
|
|
470
|
+
"data": "The failure to terminate inactive network connections increases the risk of a successful attack on the directory server. The longer an established session is in progress, the more time an attacker has to hijack the session, implement a means to passively intercept data, or compromise any protections on client access. For example, if an attacker gains control of a client computer, an existing (already authenticated) session with the directory server could allow access to the directory. The lack of confidentiality protection in LDAP-based sessions increases exposure to this vulnerability.\n\n"
|
|
471
|
+
},
|
|
472
|
+
{
|
|
473
|
+
"label": "check",
|
|
474
|
+
"data": "This applies to domain controllers. It is NA for other systems.\n\nOpen an elevated \"Command Prompt\" (run as administrator).\n\nEnter \"ntdsutil\".\n\nAt the \"ntdsutil:\" prompt, enter \"LDAP policies\".\n\nAt the \"ldap policy:\" prompt, enter \"connections\".\n\nAt the \"server connections:\" prompt, enter \"connect to server [host-name]\"\n(where [host-name] is the computer name of the domain controller).\n\nAt the \"server connections:\" prompt, enter \"q\".\n\nAt the \"ldap policy:\" prompt, enter \"show values\". \n\nIf the value for MaxConnIdleTime is greater than \"300\" (5 minutes) or is not specified, this is a finding.\n\nEnter \"q\" at the \"ldap policy:\" and \"ntdsutil:\" prompts to exit.\n\nAlternately, Dsquery can be used to display MaxConnIdleTime:\n\nOpen \"Command Prompt (Admin)\".\nEnter the following command (on a single line).\n\ndsquery * \"cn=Default Query Policy,cn=Query-Policies,cn=Directory Service, cn=Windows NT,cn=Services,cn=Configuration,dc=[forest-name]\" -attr LDAPAdminLimits \n\nThe quotes are required and dc=[forest-name] is the fully qualified LDAP name of the domain being reviewed (e.g., dc=disaost,dc=mil).\n\nIf the results do not specify a \"MaxConnIdleTime\" or it has a value greater than \"300\" (5 minutes), this is a finding."
|
|
475
|
+
},
|
|
476
|
+
{
|
|
477
|
+
"label": "fix",
|
|
478
|
+
"data": "Configure the directory service to terminate LDAP-based network connections to the directory server after 5 minutes of inactivity.\n\nOpen an elevated \"Command prompt\" (run as administrator).\n\nEnter \"ntdsutil\".\n\nAt the \"ntdsutil:\" prompt, enter \"LDAP policies\".\n\nAt the \"ldap policy:\" prompt, enter \"connections\".\n\nAt the \"server connections:\" prompt, enter \"connect to server [host-name]\" (where [host-name] is the computer name of the domain controller).\n\nAt the \"server connections:\" prompt, enter \"q\".\n\nAt the \"ldap policy:\" prompt, enter \"Set MaxConnIdleTime to 300\".\n\nEnter \"Commit Changes\" to save.\n\nEnter \"Show values\" to verify changes.\n\nEnter \"q\" at the \"ldap policy:\" and \"ntdsutil:\" prompts to exit."
|
|
479
|
+
}
|
|
480
|
+
],
|
|
481
|
+
"id": "SV-254400",
|
|
482
|
+
"title": "Windows Server 2022 directory service must be configured to terminate LDAP-based network connections to the directory server after five minutes of inactivity.",
|
|
483
|
+
"impact": 0.3
|
|
484
|
+
},
|
|
485
|
+
{
|
|
486
|
+
"tags": {
|
|
487
|
+
"check_id": "C-57905r849074_chk",
|
|
488
|
+
"severity": "medium",
|
|
489
|
+
"gid": "V-254420",
|
|
490
|
+
"rid": "SV-254420r1137691_rule",
|
|
491
|
+
"stig_id": "WN22-DC-000360",
|
|
492
|
+
"gtitle": "SRG-OS-000080-GPOS-00048",
|
|
493
|
+
"fix_id": "F-57856r849075_fix",
|
|
494
|
+
"cci": [
|
|
495
|
+
"CCI-000213"
|
|
496
|
+
],
|
|
497
|
+
"nist": [
|
|
498
|
+
"AC-3"
|
|
499
|
+
],
|
|
500
|
+
"documentable": true
|
|
501
|
+
},
|
|
502
|
+
"descriptions": [
|
|
503
|
+
{
|
|
504
|
+
"label": "default",
|
|
505
|
+
"data": "Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\n\nAccounts with the \"Allow log on through Remote Desktop Services\" user right can access a system through Remote Desktop."
|
|
506
|
+
},
|
|
507
|
+
{
|
|
508
|
+
"label": "check",
|
|
509
|
+
"data": "This applies to domain controllers, it is NA for other systems.\n\nVerify the effective setting in Local Group Policy Editor.\n\nRun \"gpedit.msc\".\n\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\n\nIf any accounts or groups other than the following are granted the \"Allow log on through Remote Desktop Services\" user right, this is a finding.\n\n- Administrators\n\nFor server core installations, run the following command:\n\nSecedit /Export /Areas User_Rights /cfg c:\\\\path\\\\filename.txt\n\nReview the text file.\n\nIf any SIDs other than the following are granted the \"SeRemoteInteractiveLogonRight\" user right, this is a finding.\n\nS-1-5-32-544 (Administrators)"
|
|
510
|
+
},
|
|
511
|
+
{
|
|
512
|
+
"label": "fix",
|
|
513
|
+
"data": "Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> Allow log on through Remote Desktop Services to include only the following accounts or groups:\n\n- Administrators"
|
|
514
|
+
}
|
|
515
|
+
],
|
|
516
|
+
"id": "SV-254420",
|
|
517
|
+
"title": "Windows Server 2022 Allow log on through Remote Desktop Services user right must only be assigned to the Administrators group on domain controllers.",
|
|
518
|
+
"impact": 0.5
|
|
519
|
+
},
|
|
520
|
+
{
|
|
521
|
+
"tags": {
|
|
522
|
+
"check_id": "C-57935r849164_chk",
|
|
523
|
+
"severity": "medium",
|
|
524
|
+
"gid": "V-254450",
|
|
525
|
+
"rid": "SV-254450r958908_rule",
|
|
526
|
+
"stig_id": "WN22-SO-000060",
|
|
527
|
+
"gtitle": "SRG-OS-000423-GPOS-00187",
|
|
528
|
+
"fix_id": "F-57886r849165_fix",
|
|
529
|
+
"satisfies": [
|
|
530
|
+
"SRG-OS-000423-GPOS-00187",
|
|
531
|
+
"SRG-OS-000424-GPOS-00188"
|
|
532
|
+
],
|
|
533
|
+
"cci": [
|
|
534
|
+
"CCI-002418",
|
|
535
|
+
"CCI-002421"
|
|
536
|
+
],
|
|
537
|
+
"nist": [
|
|
538
|
+
"SC-8",
|
|
539
|
+
"SC-8 (1)"
|
|
540
|
+
],
|
|
541
|
+
"documentable": true
|
|
542
|
+
},
|
|
543
|
+
"descriptions": [
|
|
544
|
+
{
|
|
545
|
+
"label": "default",
|
|
546
|
+
"data": "Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but not all information is encrypted. If this policy is enabled, outgoing secure channel traffic will be encrypted and signed.\n\n"
|
|
547
|
+
},
|
|
548
|
+
{
|
|
549
|
+
"label": "check",
|
|
550
|
+
"data": "If the following registry value does not exist or is not configured as specified, this is a finding:\n\nRegistry Hive: HKEY_LOCAL_MACHINE \nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\\n\nValue Name: RequireSignOrSeal\n\nValue Type: REG_DWORD\nValue: 0x00000001 (1)"
|
|
551
|
+
},
|
|
552
|
+
{
|
|
553
|
+
"label": "fix",
|
|
554
|
+
"data": "Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> Domain member: Digitally encrypt or sign secure channel data (always) to \"Enabled\"."
|
|
555
|
+
}
|
|
556
|
+
],
|
|
557
|
+
"id": "SV-254450",
|
|
558
|
+
"title": "Windows Server 2022 setting Domain member: Digitally encrypt or sign secure channel data (always) must be configured to Enabled.",
|
|
559
|
+
"impact": 0.5
|
|
560
|
+
},
|
|
561
|
+
{
|
|
562
|
+
"tags": {
|
|
563
|
+
"check_id": "C-57965r1050598_chk",
|
|
564
|
+
"severity": "medium",
|
|
565
|
+
"gid": "V-254480",
|
|
566
|
+
"rid": "SV-254480r1137699_rule",
|
|
567
|
+
"stig_id": "WN22-SO-000360",
|
|
568
|
+
"gtitle": "SRG-OS-000478-GPOS-00223",
|
|
569
|
+
"fix_id": "F-57916r849255_fix",
|
|
570
|
+
"cci": [
|
|
571
|
+
"CCI-002450"
|
|
572
|
+
],
|
|
573
|
+
"nist": [
|
|
574
|
+
"SC-13 b"
|
|
575
|
+
],
|
|
576
|
+
"documentable": true
|
|
577
|
+
},
|
|
578
|
+
"descriptions": [
|
|
579
|
+
{
|
|
580
|
+
"label": "default",
|
|
581
|
+
"data": "This setting ensures the system uses algorithms that are FIPS-compliant for encryption, hashing, and signing. FIPS-compliant algorithms meet specific standards established by the U.S. Government and must be the algorithms used for all OS encryption functions."
|
|
582
|
+
},
|
|
583
|
+
{
|
|
584
|
+
"label": "check",
|
|
585
|
+
"data": "This is NA if the host is running SharePoint. If the following registry value does not exist or is not configured as specified, this is a finding:\n\nRegistry Hive: HKEY_LOCAL_MACHINE\nRegistry Path: \\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\FIPSAlgorithmPolicy\\\\\n\nValue Name: Enabled\n\nValue Type: REG_DWORD\nValue: 0x00000001 (1)\n \nClients with this setting enabled will not be able to communicate via digitally encrypted or signed protocols with servers that do not support these algorithms. Both the browser and web server must be configured to use TLS; otherwise the browser will not be able to connect to a secure site."
|
|
586
|
+
},
|
|
587
|
+
{
|
|
588
|
+
"label": "fix",
|
|
589
|
+
"data": "Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing to \"Enabled\"."
|
|
590
|
+
}
|
|
591
|
+
],
|
|
592
|
+
"id": "SV-254480",
|
|
593
|
+
"title": "Windows Server 2022 must be configured to use FIPS-compliant algorithms for encryption, hashing, and signing.",
|
|
594
|
+
"impact": 0.5
|
|
595
|
+
},
|
|
596
|
+
{
|
|
597
|
+
"tags": {
|
|
598
|
+
"check_id": "C-57985r849314_chk",
|
|
599
|
+
"severity": "high",
|
|
600
|
+
"gid": "V-254500",
|
|
601
|
+
"rid": "SV-254500r958726_rule",
|
|
602
|
+
"stig_id": "WN22-UR-000100",
|
|
603
|
+
"gtitle": "SRG-OS-000324-GPOS-00125",
|
|
604
|
+
"fix_id": "F-57936r849315_fix",
|
|
605
|
+
"cci": [
|
|
606
|
+
"CCI-002235"
|
|
607
|
+
],
|
|
608
|
+
"nist": [
|
|
609
|
+
"AC-6 (10)"
|
|
610
|
+
],
|
|
611
|
+
"documentable": true
|
|
612
|
+
},
|
|
613
|
+
"descriptions": [
|
|
614
|
+
{
|
|
615
|
+
"label": "default",
|
|
616
|
+
"data": "Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\n\nAccounts with the \"Debug programs\" user right can attach a debugger to any process or to the kernel, providing complete access to sensitive and critical operating system components. This right is given to Administrators in the default configuration."
|
|
617
|
+
},
|
|
618
|
+
{
|
|
619
|
+
"label": "check",
|
|
620
|
+
"data": "Verify the effective setting in Local Group Policy Editor.\n\nRun \"gpedit.msc\".\n\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\n\nIf any accounts or groups other than the following are granted the \"Debug programs\" user right, this is a finding:\n\n- Administrators\n\nFor server core installations, run the following command:\n\nSecedit /Export /Areas User_Rights /cfg c:\\\\path\\\\filename.txt\n\nReview the text file.\n\nIf any SIDs other than the following are granted the \"SeDebugPrivilege\" user right, this is a finding:\n\nS-1-5-32-544 (Administrators)\n\nIf an application requires this user right, this would not be a finding.\n\nVendor documentation must support the requirement for having the user right.\n\nThe requirement must be documented with the Information System Security Officer (ISSO).\n\nThe application account must meet requirements for application account passwords, such as length (WN22-00-000050) and required frequency of changes (WN22-00-000060).\n\nPasswords for application accounts with this user right must be protected as highly privileged accounts."
|
|
621
|
+
},
|
|
622
|
+
{
|
|
623
|
+
"label": "fix",
|
|
624
|
+
"data": "Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> Debug programs to include only the following accounts or groups:\n\n- Administrators"
|
|
625
|
+
}
|
|
626
|
+
],
|
|
627
|
+
"id": "SV-254500",
|
|
628
|
+
"title": "Windows Server 2022 debug programs user right must only be assigned to the Administrators group.",
|
|
629
|
+
"impact": 0.7
|
|
630
|
+
},
|
|
631
|
+
{
|
|
632
|
+
"tags": {
|
|
633
|
+
"check_id": "C-57995r849344_chk",
|
|
634
|
+
"severity": "medium",
|
|
635
|
+
"gid": "V-254510",
|
|
636
|
+
"rid": "SV-254510r958726_rule",
|
|
637
|
+
"stig_id": "WN22-UR-000200",
|
|
638
|
+
"gtitle": "SRG-OS-000324-GPOS-00125",
|
|
639
|
+
"fix_id": "F-57946r849345_fix",
|
|
640
|
+
"cci": [
|
|
641
|
+
"CCI-002235"
|
|
642
|
+
],
|
|
643
|
+
"nist": [
|
|
644
|
+
"AC-6 (10)"
|
|
645
|
+
],
|
|
646
|
+
"documentable": true
|
|
647
|
+
},
|
|
648
|
+
"descriptions": [
|
|
649
|
+
{
|
|
650
|
+
"label": "default",
|
|
651
|
+
"data": "Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.\n\nAccounts with the \"Profile single process\" user right can monitor nonsystem processes performance. An attacker could use this to identify processes to attack."
|
|
652
|
+
},
|
|
653
|
+
{
|
|
654
|
+
"label": "check",
|
|
655
|
+
"data": "Verify the effective setting in Local Group Policy Editor.\n\nRun \"gpedit.msc\".\n\nNavigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.\n\nIf any accounts or groups other than the following are granted the \"Profile single process\" user right, this is a finding:\n\n- Administrators\n\nFor server core installations, run the following command:\n\nSecedit /Export /Areas User_Rights /cfg c:\\\\path\\\\filename.txt\n\nReview the text file.\n\nIf any SIDs other than the following are granted the \"SeProfileSingleProcessPrivilege\" user right, this is a finding:\n\nS-1-5-32-544 (Administrators)"
|
|
656
|
+
},
|
|
657
|
+
{
|
|
658
|
+
"label": "fix",
|
|
659
|
+
"data": "Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> Profile single process to include only the following accounts or groups:\n\n- Administrators"
|
|
660
|
+
}
|
|
661
|
+
],
|
|
662
|
+
"id": "SV-254510",
|
|
663
|
+
"title": "Windows Server 2022 profile single process user right must only be assigned to the Administrators group.",
|
|
664
|
+
"impact": 0.5
|
|
665
|
+
}
|
|
666
|
+
],
|
|
667
|
+
"checksum": {
|
|
668
|
+
"algorithm": "sha256",
|
|
669
|
+
"value": "ca3ab7edf62a0d741bb72ffb730890715cc7bb45c46fe3e9544485585bf1e9b6"
|
|
670
|
+
}
|
|
671
|
+
}
|