Title

Ejection of removable NTFS media must be restricted to Administrators. (Cat II impact)

Discussion

Removable hard drives, if they are not properly configured, can be formatted and ejected by users who are not members of the Administrators Group. Formatting and ejecting removable NTFS media must only be done by administrators.

Check Content

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ Value Name: AllocateDASD Value Type: REG_SZ Value: 0

Fix Text

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Devices: Allowed to format and eject removable media" to "Administrators".

Additional Identifiers

Rule ID:

Vulnerability ID: V-1171

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.