74.28 (L1) Ensure 'Restore Files And Directories' is set to 'Administrators'

Information

This policy setting determines which users can bypass file, directory, registry, and other persistent object permissions when restoring backed up files and directories on computers that run Windows Vista (or newer) in your environment. This user right also determines which users can set valid security principals as object owners; it is similar to the Back up files and directories user right.

The recommended state for this setting is: Administrators

Note: This user right is considered a 'sensitive privilege' for the purposes of auditing.

An attacker with the Restore files and directories user right could restore sensitive data to a computer and overwrite data that is more recent, which could lead to loss of important data, data corruption, or a denial of service. Attackers could overwrite executable files that are used by legitimate administrators or system services with versions that include malicious software to grant themselves elevated privileges, compromise data, or install backdoors for continued access to the computer.

Note: Even if the following countermeasure is configured, an attacker could still restore data to a computer in a domain that is controlled by the attacker. Therefore, it is critical that organizations carefully protect the media that is used to back up data.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Administrators

User Rights\Restore files and directories

Note: Include only one User or Group per line in the Settings Catalog configuration screen.

Impact:

If you remove the Restore files and directories user right from the Backup Operators group and other accounts you could make it impossible for users who have been delegated specific tasks to perform those tasks. You should verify that this change won't negatively affect the ability of your organization's personnel to do their jobs.

See Also

https://workbench.cisecurity.org/benchmarks/16852