Title

The maximum number of error reports to queue on a system must be configured to 50 or greater. (Cat II impact)

Discussion

The error reporting queue is stored locally on the system and contains the error reports until they have been manually removed or automatically sent to the local collector or DOD-wide collector (if defined). Once a report has been sent to a collector, it is moved to the report archive. Old reports are deleted as new ones arrive once the maximum limit has been met.

Check Content

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\ Value Name: MaxQueueCount Type: REG_DWORD Value: 0x00000032 (50) (or greater)

Fix Text

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Error Reporting -> Advanced Error Reporting Settings -> "Configure Report Queue" to "Enabled" with "Maximum number of reports to queue:" set to "50" or greater.

Additional Identifiers

Rule ID: SV-71943r1_rule

Vulnerability ID: V-57473

Group Title: WINER-000015

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.