Check: WN12-SO-000023
Microsoft Windows Server 2012/2012 R2 Domain Controller STIG:
WN12-SO-000023
(in versions v3 r7 through v2 r7)
Title
The Windows dialog box title for the legal banner must be configured. (Cat III impact)
Discussion
Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.
Check Content
If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: LegalNoticeCaption Value Type: REG_SZ Value: See message title options below "DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or a site-defined equivalent. If a site-defined title is used, it can in no case contravene or modify the language of the banner text required in V-1089. Automated tools may only search for the titles defined above. If a site-defined title is used, a manual review will be required.
Fix Text
Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Interactive Logon: Message title for users attempting to log on" to "DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or a site-defined equivalent. If a site-defined title is used, it can in no case contravene or modify the language of the banner text required in V-1089.
Additional Identifiers
Rule ID: SV-226289r794510_rule
Vulnerability ID: V-226289
Group Title: SRG-OS-000023-GPOS-00006
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000048 |
The information system displays an organization-defined system use notification message or banner before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. |
| CCI-001384 |
The information system, for publicly accessible systems, displays system use information organization-defined conditions before granting further access. |
| CCI-001385 |
The information system, for publicly accessible systems, displays references, if any, to monitoring that are consistent with privacy accommodations for such systems that generally prohibit those activities. |
| CCI-001386 |
The information system, for publicly accessible systems, displays references, if any, to recording that are consistent with privacy accommodations for such systems that generally prohibit those activities. |
| CCI-001387 |
The information system, for publicly accessible systems, displays references, if any, to auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities. |
| CCI-001388 |
The information system, for publicly accessible systems, includes a description of the authorized uses of the system. |
Controls
| Number | Title |
|---|---|
| AC-8 |
System Use Notification |