Title

The option to prevent the password in dial-up networking from being saved is not enabled. (Cat II impact)

Discussion

The default Windows configuration enables the option to save the password used to gain access to a remote server using the dial-up networking feature. With this option enabled, an unauthorized user who gains access to a Windows machine would also have access to remote servers with which the machine uses dial-up networking to communicate. Disabling this option will introduce another layer of security and help limit the scope of any security compromise to the local machine.

Check Content

Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “MSS: (DisableSavePassword) Prevent the dial-up password from being saved (recommended)” is not set to “Enabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Services\RasMan\Parameters\ Value Name: DisableSavePassword Value Type: REG_DWORD Value: 1

Fix Text

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “MSS: (DisableSavePassword) Prevent the dial-up password from being saved (recommended)” to “Enabled”.

Additional Identifiers

Rule ID: SV-1139r1_rule

Vulnerability ID: V-1139

Group Title: Dial Up Password Saved

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.