Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The Windows Server 2025 "Deny log on as a service" user right on domain-joined member servers must be configured to prevent access from highly privileged domain accounts. No other groups or accounts must be assigned this right.
Description
Discussion Text
Inappropriately granting user rights provides system, administrative, and other high-level capabilities.
The "Deny log on as a service" user right defines accounts that are denied logon as a service.
In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain.
Incorrect configurations could prevent services from starting and result in a denial of service.
The "Deny log on as a service" user right defines accounts that are denied logon as a service.
In an Active Directory Domain, denying logons to the Enterprise Admins and Domain Admins groups on lower-trust systems helps mitigate the risk of privilege escalation from credential theft attacks, which could lead to the compromise of an entire domain.
Incorrect configurations could prevent services from starting and result in a denial of service.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.