Detections
Analytics
2.3.10.8 Configure 'Network access: Remotely accessible registry paths'
Information
This policy setting determines which registry paths will be accessible over the network, regardless of the users or groups listed in the access control list (ACL) of the winreg registry key.Note: This setting does not exist in Windows XP. There was a setting with that name in Windows XP, but it is called 'Network access: Remotely accessible registry paths and sub-paths' in Windows Server 2003, Windows Vista, and Windows Server 2008 (non-R2).
Note #2: When you configure this setting you specify a list of one or more objects. The delimiter used when entering the list is a line feed or carriage return, that is, type the first object on the list, press the Enter button, type the next object, press Enter again, etc. The setting value is stored as a comma-delimited list in group policy security templates. It is also rendered as a comma-delimited list in Group Policy Editor's display pane and the Resultant Set of Policy console. It is recorded in the registry as a line-feed delimited list in a REG_MULTI_SZ value.
The recommended state for this setting is:
System\CurrentControlSet\Control\ProductOptions
System\CurrentControlSet\Control\Server Applications
Software\Microsoft\Windows NT\CurrentVersion
Rationale:
The registry is a database that contains computer configuration information, and much of the information is sensitive. An attacker could use this information to facilitate unauthorized activities. To reduce the risk of such an attack, suitable ACLs are assigned throughout the registry to help protect it from access by unauthorized users.
Solution
To establish the recommended configuration via GP, set the following UI path to: System\CurrentControlSet\Control\ProductOptionsSystem\CurrentControlSet\Control\Server Applications
Software\Microsoft\Windows NT\CurrentVersion
Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Remotely accessible registry paths
Impact:
None - this is the default behavior. However, if you remove the default registry paths from the list of accessible ones, remote management tools such as the Microsoft Baseline Security Analyzer and Microsoft Systems Management Server could fail, as they require remote access to the registry to properly monitor and manage computers.
Note: If you want to allow remote access, you must also enable the Remote Registry service.
Default Value:
System\CurrentControlSet\Control\ProductOptions
System\CurrentControlSet\Control\Server Applications
Software\Microsoft\Windows NT\CurrentVersion
References:
CCE-37194-8
See Also
Item Details
References: CSCv6|14, CSCv6|14.6, CSCv6|16, CSCv7|14.9
Plugin: Windows
Control ID: f69a344737926f9a6594e2af59bfd0aae8bd48d25600953d82b03c54c30c002c