SV-226269r877392: Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key. | Microsoft Windows Server 2012/2012 R2 Domain Controller STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key.

Description

Discussion Text

Permissions on the Active Setup\Installed Components registry key must only allow privileged accounts to add or change registry values. If standard user accounts have these permissions, there is a potential for programs to run with elevated privileges when a privileged user logs on to the system.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-002235SV-52956V-32282

References

DPMS Target Microsoft Windows Server 2012-2012 R2 DC DISA DPMS Target Microsoft Windows Server 2012-2012 R2 DC 4217

Checks

DISA STIG (Manual Reference)

Run "Regedit".
Navigate to the following registry keys and review the permissions:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\ (64-bit systems)

If the default permissions listed below have been changed, this is a finding.

Users - Read
Administrators - Full Control
SYSTEM - Full Control
CREATOR OWNER - Full Control (Subkeys only)
ALL APPLICATION PACKAGES - Read

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

# Windows PowerShell
# Reconstructed from oval:mil.disa.fso.windows:def:5175
# Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- 32-bit Installed Components key has no bad rights for non-(users, adminstrator, system, creator owner, all application packages): <set> composition (base object oval:mil.disa.fso.windows:obj:517501): member unresolved -- no extractor for field "key_wow64_res"
#   - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- 32-bit Installed Components key has no non-(users, adminstrator, system, creator owner, all application packages) rights to check: <set> composition (base object oval:mil.disa.fso.windows:obj:517501): member unresolved -- cannot derive an existence probe for this object type
#   - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- 32-bit Installed Components key has no bad rights for non-(Adminstrators, SYSTEM, CREATOR OWNERS): <set> composition (base object oval:mil.disa.fso.windows:obj:517501): member unresolved -- no extractor for field "key_wow64_res"
#   - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- 32-bit Installed Components key has no non-(Adminstrators, SYSTEM, CREATOR OWNERS) rights to check: <set> composition (base object oval:mil.disa.fso.windows:obj:517501): member unresolved -- cannot derive an existence probe for this object type
#   - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- 64-bit Installed Components key has no bad rights for non-(users, adminstrator, system, creator owner, all application packages): <set> composition (base object oval:mil.disa.fso.windows:obj:517505): member unresolved -- no extractor for field "key_wow64_res"
#   - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- 64-bit Installed Components key has no non-(users, adminstrator, system, creator owner, all application packages) rights to check: <set> composition (base object oval:mil.disa.fso.windows:obj:517505): member unresolved -- cannot derive an existence probe for this object type
#   - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- 64-bit Installed Components key has no bad rights for non-(Adminstrators, SYSTEM, CREATOR OWNERS): <set> composition (base object oval:mil.disa.fso.windows:obj:517505): member unresolved -- no extractor for field "key_wow64_res"
#   - regkeyeffectiverights53_object (regkeyeffectiverights53_test) -- 64-bit Installed Components key has no non-(Adminstrators, SYSTEM, CREATOR OWNERS) rights to check: <set> composition (base object oval:mil.disa.fso.windows:obj:517505): member unresolved -- cannot derive an existence probe for this object type

# HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components exists
# registry_object (registry_test)
function test_1 {
  return ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components' -Name ''))
}
# Is this a 64-Bit Operating System.
# wmi57_object (wmi57_test)
function test_6 {
  return (((Get-CimInstance -Namespace 'root\cimv2' -Query 'SELECT AddressWidth FROM win32_processor' | Select-Object -First 1) | Select-Object -ExpandProperty 'AddressWidth') -eq '64')
}
# Is this a 64-Bit Operating System.
# wmi57_object (wmi57_test)
function test_7 {
  return (((Get-CimInstance -Namespace 'root\cimv2' -Query 'SELECT AddressWidth FROM win32_processor' | Select-Object -First 1) | Select-Object -ExpandProperty 'AddressWidth') -eq '64')
}
# HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components exists
# registry_object (registry_test)
function test_8 {
  return ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components' -Name ''))
}

if ((test_1 -and (test_6 -or (test_7 -and test_8)))) {
  Write-Output "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
} else {
  Write-Output "FAIL (or see MANUAL REVIEW note above)"
}

Assessment Script Powered by AISyntax-verified

A standalone PowerShell script to assess this control automatically. Review before running it in your environment.

Syntax-checked as valid PowerShell. Not executed here — running it for real needs the actual ms_windows_2012_and_2012_r2_dc target this check assesses.

# OVAL Definition: oval:mil.disa.fso.windows:def:5175
$regPath = "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components"
$regPath64 = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components"
$expectedRights = [System.Security.AccessControl.FileSystemRights]::Read
$expectedRights64 = $expectedRights
if (-not (Test-Path $regPath)) { Write-Output "PASS"; exit 0 }
if (-not (Test-Path $regPath64)) { $regPath64 = $null }
$acl = Get-Acl $regPath
if ($acl.Access -notcontains @{Identity="NT AUTHORITY\SYSTEM";AccessControlType="Allow";FileSystemRights=$expectedRights;IsInherited=$false} `
   -and $acl.Access -notcontains @{Identity="BUILTIN\Administrators";AccessControlType="Allow";FileSystemRights=$expectedRights;IsInherited=$false} `
   -and $acl.Access -notcontains @{Identity="NT AUTHORITY\SYSTEM";AccessControlType="Allow";FileSystemRights=$expectedRights;IsInherited=$false} `
   -and $acl.Access -notcontains @{Identity="S-1-15-2-1";AccessControlType="Allow";FileSystemRights=$expectedRights;IsInherited=$false} `
   -and $acl.Access -notcontains @{Identity="S-1-16-1024";AccessControlType="Allow";FileSystemRights=$expectedRights;IsInherited=$false}) { Write-Output "FAIL"; exit 1 }
if ($regPath64 -and (Get-Acl $regPath64).Access -notcontains @{Identity="NT AUTHORITY\SYSTEM";AccessControlType="Allow";FileSystemRights=$expectedRights64;IsInherited=$false} `
   -and $acl.Access -notcontains @{Identity="BUILTIN\Administrators";AccessControlType="Allow";FileSystemRights=$expectedRights64;IsInherited=$false} `
   -and $acl.Access -notcontains @{Identity="NT AUTHORITY\SYSTEM";AccessControlType="Allow";FileSystemRights=$expectedRights64;IsInherited=$false} `
   -and $acl.Access -notcontains @{Identity="S-1-15-2-1";AccessControlType="Allow";FileSystemRights=$expectedRights64;IsInherited=$false} `
   -and $acl.Access -notcontains @{Identity="S-1-16-1024";AccessControlType="Allow";FileSystemRights=$expectedRights64;IsInherited=$false}) { Write-Output "FAIL"; exit 1 }
Write-Output "PASS"

Remediation

Maintain the default permissions of the following registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\ (64-bit systems only)
 
Users - Read
Administrators - Full Control
SYSTEM - Full Control
CREATOR OWNER - Full Control (Subkeys only)
ALL APPLICATION PACKAGES - Read