Title

The Recovery Console option is set to permit automatic logon to the system. (Cat I impact)

Discussion

This is a Category 1 finding because if this option is set, the Recovery Console does not require you to provide a password and will automatically log on to the system, giving Administrator access to system files. By default, the Recovery Console requires you to provide the password for the Administrator account before accessing the system.

Check Content

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Recovery Console: Allow automatic administrative logon” is not set to “Disabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\ Value Name: SecurityLevel Value Type: REG_DWORD Value: 0

Fix Text

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Recovery Console: Allow automatic administrative logon” to “Disabled”.

Additional Identifiers

Rule ID: SV-29023r1_rule

Vulnerability ID: V-1159

Group Title: Recovery Console - Automatic Logon

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.