5.16 (L2) Ensure 'Remote Access Auto Connection Manager (RasAuto)' is set to 'Disabled'

Information

Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address.
The recommended state for this setting is: Disabled.

Rationale:
The function of this service is to provide a 'demand dial' type of functionality. In a high security environment, it is preferred that any remote 'dial' connections (whether they be legacy dial-in POTS or VPN) are initiated by the user, not automatically by the system.

Solution

To establish the recommended configuration via GP, set the following UI path to: Disabled.
Computer Configuration\Policies\Windows Settings\Security Settings\System Services\Remote Access Auto Connection Manager

Impact:
'Dial on demand' functionality will no longer operate - remote dial-in (POTS) and VPN connections must be initiated manually by the user.

Default Value:
Manual

See Also

https://workbench.cisecurity.org/benchmarks/14249

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv6|9.1, CSCv7|9.2

Plugin: Windows

Control ID: cb057737603ab2adec152e57806b4d81e94168437ae985db1222c5d685099184