Check: WN11-CC-000165
Microsoft Windows 11 STIG:
WN11-CC-000165
(in versions v1 r6 through v1 r1)
Title
Unauthenticated RPC clients must be restricted from connecting to the RPC server. (Cat II impact)
Discussion
Configuring RPC to restrict unauthenticated RPC clients from connecting to the RPC server will prevent anonymous connections.
Check Content
If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows NT\Rpc\ Value Name: RestrictRemoteClients Value Type: REG_DWORD Value: 1
Fix Text
Configure the policy value for Computer Configuration >> Administrative Templates >> System >> Remote Procedure Call >> "Restrict Unauthenticated RPC clients" to "Enabled" and "Authenticated".
Additional Identifiers
Rule ID: SV-253383r877039_rule
Vulnerability ID: V-253383
Group Title: SRG-OS-000379-GPOS-00164
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-001937 |
The device used in the information system implementation of multifactor authentication for network access to privileged accounts meets organization-defined strength of mechanism requirements. |
| CCI-001967 |
The information system authenticates organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based. |