Title

Unnecessary services must be disabled. (Cat II impact)

Discussion

Unnecessary services increase the attack surface of a system. Some services may be run under the local System account, which generally has more permissions than required by the service. Compromising a service could allow an intruder to obtain system permissions and open the system to a variety of attacks.

Check Content

Run "Services.msc". If services listed below are found, that are not disabled, and the site does not have documented exceptions for these, this is a finding. Alerter Application Layer Gateway Service Application Management ASP .NET State Service Certificate Services Client Service for NetWare ClipBook Cluster Service COM+ System Application DHCP Server Distributed Link Tracking Client Distributed Link Tracking Server Distributed Transaction Coordinator Fax Service File Server for Macintosh FTP Publishing Service Help and Support HTTP SSL Human Interface Device Access IAS Jet Database Access IIS Admin Service IMAPI CD-Burning COM Service Indexing Service Infrared Monitor Internet Authentication Service IP Version 6 Helper Service License Logging Service Message Queuing Message Queuing Down Level Clients Message Queuing Triggers Messenger Microsoft POP3 Service MSSQL$UDDI MSSQLServerADHelper .NET Framework Support Service NetMeeting Remote Desktop Sharing Network DDE Network DDE DSDM Network News Transport Protocol (NNTP) Portable Media Serial Number Print Server for Macintosh Print Spooler Remote Access Auto Connection Manager Remote Access Connection Manager Remote Desktop Help Session Manager Remote Installation Remote Server Manager Remote Server Monitor Remote Storage Notification Remote Storage Server Resultant Set of Policy Provider Routing and Remote Access SAP Agent Secondary Logon Shell Hardware Detection Simple Mail Transport Protocol (SMTP) Simple TCP/IP Services Single Instance Storage Groveler SNMP Service SNMP Trap Service Special Administration Console Helper Task Scheduler - See separate vulnerability WINSV-000106/V-30037 TCP/IP Print Server Telephony Telnet Terminal Services Terminal Services Licensing Terminal Services Session Directory Themes Trivial FTP Daemon Uninterruptible Power Supply Upload Manager Virtual Disk Service WebClient Web Element Manager Windows Audio Windows Firewall/Internet Connection Sharing (ICS) Windows Image Acquisition (WIA) Windows Internet Name Service (WINS) Windows Media Services Windows System Resource Manager WinHTTP Web Proxy Auto-Discovery Service Wireless Configuration World Wide Web Publishing Service

Fix Text

Configure the system to disable any services that are not required.

Additional Identifiers

Rule ID: SV-3487r2_rule

Vulnerability ID: V-3487

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.