Title

The Secondary Logon service must be disabled on Windows 10. (Cat II impact)

Discussion

The Secondary Logon service provides a means for entering alternate credentials, typically used to run commands with elevated privileges. Using privileged credentials in a standard user session can expose those credentials to theft.

Check Content

Run "Services.msc". Locate the "Secondary Logon" service. If the "Startup Type" is not "Disabled" or the "Status" is "Running", this is a finding.

Fix Text

Configure the "Secondary Logon" service "Startup Type" to "Disabled".

Additional Identifiers

Rule ID: SV-220732r958478_rule

Vulnerability ID: V-220732

Group Title: SRG-OS-000095-GPOS-00049

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.