Title

Enable restore points for device driver installations. (Cat III impact)

Discussion

This check verifies that a system restore point will be created when a new device driver is installed.

Check Content

Vista/7 - If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows\DeviceInstall\Settings\ Value Name: DisableSystemRestore Type: REG_DWORD Value: 0

Fix Text

Windows 7 - Configure the policy value for Computer Configuration -> Administrative Templates -> System -> Device Installation “Prevent creation of a system restore point during device activity that would normally prompt creation of a restore point” to “Disabled”.

Additional Identifiers

Rule ID: SV-25147r1_rule

Vulnerability ID: V-15701

Group Title: Device Install – Drivers System Restore Point

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.