Windows 7 Security Technical Implementation Guide

The Windows 7 Security Technical Implementation Guide (V1 R32) has 296 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

296STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R32

CurrentPublished Wed Jun 17 2020

Auditing Access of Global System Objects must be turned off.

Windows 7 Security Technical Implementation Guide

Assessment Title

Rule Text

Auditing Access of Global System Objects must be turned off.

Description

Discussion Text

This setting prevents the system from setting up a default system access control list for certain system objects, which could create a very large number of security events, filling the security log in Windows and making it difficult to identify actual issues.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-14228

Rule

SV-25027r2_rule

Severity

medium

Rule Version

3.123

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Analyze the system using the Security Configuration and Analysis snap-in.
Expand the Security Configuration and Analysis tree view. 
Navigate to Local Policies -> Security Options. 

If the value for "Audit: Audit the access of global system objects" is not set to "Disabled", this is a finding.

The policy referenced configures the following registry value:

Registry Hive: HKEY_LOCAL_MACHINE 
Registry Path: \System\CurrentControlSet\Control\Lsa

Value Name: AuditBaseObjects

Value Type: REG_DWORD
Value: 0

Implementation Procedure

Fix Text

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Audit: Audit the access of global system objects" to "Disabled".

STIG check 57 of 296 in the Windows 7 STIG checklist

← Previous · V-14225Administrator passwords must be changed as required.Next · V-14229 →Audit of backup and restore privileges is not turned off.