2.2.31 Ensure 'Modify an object label' is set to 'No One'

Information

This privilege determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Processes running under a user account can modify the label of an object owned by that user to a lower level without this privilege.

The recommended state for this setting is: No One.

Rationale:

By modifying the integrity label of an object owned by another user a malicious user may cause them to execute code at a higher level of privilege than intended.

Solution

To establish the recommended configuration via GP, set the following UI path to No One:

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Modify an object label

Impact:

None - this is the default behavior.

Default Value:

No one.

See Also

https://workbench.cisecurity.org/files/2700

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(7)(b), CSCv6|16

Plugin: Windows

Control ID: f9c0c9fdefdd658353687c2d495b4a0b0bf8837812487bcae9b7ae2ef8ea3d62