18.9.23.1 (L2) Ensure 'Support device authentication using certificate' is set to 'Enabled: Automatic'

Information

This policy setting allows you to set support for Kerberos to attempt authentication using the certificate for the device to the domain.

Support for device authentication using certificate will require connectivity to a DC in the device account domain which supports certificate authentication for computer accounts.

The recommended state for this setting is: Enabled: Automatic

Having stronger device authentication with the use of certificates is strongly encouraged over standard username and password authentication. Having this set to Automatic will allow certificate based authentication to be used whenever possible.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled: Automatic :

Computer Configuration\Policies\Administrative Templates\System\Kerberos\Support device authentication using certificate

Note: This Group Policy path may not exist by default. It is provided by the Group Policy template Kerberos.admx/adml that is included with the Microsoft Windows 10 RTM (Release 1507) Administrative Templates (or newer).

Impact:

None - this is the default behavior.

See Also

https://workbench.cisecurity.org/benchmarks/15105

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-3(1)

Plugin: Windows

Control ID: 894fb57c85b824c55fe9cecab5e967135deeb4223c6a9672c90091b11bd3ecb6