Windows 7 Security Technical Implementation Guide

The Windows 7 Security Technical Implementation Guide (V1 R32) has 296 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

296STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R32

CurrentPublished Wed Jun 17 2020

File share permissions must be reconfigured to remove the Everyone group.

Windows 7 Security Technical Implementation Guide

Assessment Title

Rule Text

File share permissions must be reconfigured to remove the Everyone group.

Description

Discussion Text

Shares on a system can provide network access, exposing sensitive information. If a share is necessary, permissions must be reconfigured to give the minimum access to those accounts that require it.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-3245

Rule

SV-25006r2_rule

Severity

medium

Rule Version

2.015

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Open the Computer Management Console.
Expand the "System Tools" object in the left pane.
Expand the "Shared Folders" object.
Select the "Shares" object.
Right click any user-created shares (ignore administrative shares; the system will prompt you if Properties are selected for administrative shares).
Select "Properties".
Select the "Share Permissions" tab.

If user-created file shares have not been reconfigured to remove ACL permissions from the "Everyone" group, this is a finding.

If shares created by applications require the "Everyone" group, this must be documented with the ISSO.

Implementation Procedure

Fix Text

Remove permissions from the "Everyone" group from locally-created file shares and assign them to authorized groups.

STIG check 224 of 296 in the Windows 7 STIG checklist

← Previous · V-32282Standard user accounts must only have Read permissions to the Active Setup\Installed Components registry key.Next · V-3337 →Anonymous SID/Name translation must not be allowed.