Check: WN11-UR-000100
Microsoft Windows 11 STIG:
WN11-UR-000100
(in versions v1 r6 through v1 r1)
Title
The "Force shutdown from a remote system" user right must only be assigned to the Administrators group. (Cat II impact)
Discussion
Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities. Accounts with the "Force shutdown from a remote system" user right can remotely shut down a system which could result in a DoS.
Check Content
Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any groups or accounts other than the following are granted the "Force shutdown from a remote system" user right, this is a finding: Administrators
Fix Text
Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Force shutdown from a remote system" to only include the following groups or accounts: Administrators
Additional Identifiers
Rule ID: SV-253497r877392_rule
Vulnerability ID: V-253497
Group Title: SRG-OS-000324-GPOS-00125
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-002205 |
The information system uniquely identifies and authenticates source by organization, system, application, and/or individual for information transfer. |
| CCI-002235 |
The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. |