Windows 2008 Domain Controller Security Technical Implementation Guide

The Windows 2008 Domain Controller Security Technical Implementation Guide (V6 R47) has 245 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

245STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V6 · R47

CurrentPublished Wed Jun 17 2020

Terminal Services is not configured to limit users to one remote session (Terminal Server Role)

Windows 2008 Domain Controller Security Technical Implementation Guide

Assessment Title

Rule Text

Terminal Services is not configured to limit users to one remote session (Terminal Server Role)

Description

Discussion Text

This setting limits users to one remote session. It is possible, if this setting is disabled, for users to establish multiple sessions.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-3449

Rule

SV-16938r1_rule

Severity

medium

Rule Version

5.038

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

2008 - If the following registry value doesn’t exist or its value is not set to 1, then this is a finding:
Registry Hive:  HKEY_LOCAL_MACHINE
Subkey:  \Software\Policies\Microsoft\Windows NT\Terminal Services\

Value Name:   fSingleSessionPerUser
Type: REG_DWORD
Value:  1

Documentable Explanation: If the system has the role as a Terminal Server, or the site is using terminal services for remote administration this requirement needs to be documented with the IAO.

Implementation Procedure

Fix Text

2008 - Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Terminal Services -> Terminal Server -> Connections "Restrict Terminal Server users to a Single Remote Session" to "Enabled".

STIG check 187 of 245 in the Windows 2008 Domain Controller STIG checklist

← Previous · V-3385The system must be configured to require case insensitivity for non-Windows subsystems.Next · V-3454 →Terminal Services is not configured with the client connection encryption set to the required level.