Hello Mehul, thank you for the information, can you please send me the link to
the document that contains the statement that Deny logon through Terminal
Services should "only" be denied to the Guests group.
Secutor Prime also reported the same problem, once Threat Guard was aware of
the issue Secutor Prime was corrected so that it did not fail a check because
additional user account were restricted using the various deny user rights in
group policy.
The FDCC Q3 2007 XP Group Policy requires a password length of 12 , if the
organization requires a password length of 24 that check would fail. Secutor
Prime use to fail this check until it was correct so that the check passes
if its 12 or greater.
Best Regards --John
-------------- Original message ----------------------
From: "Mehul" <mrevankar@tenablesecurity.com>
> When I scan the same workstation with Nessus and the
FDCC_Desktops_v90.audit., I get ten failures.
As an example the file checks
<item>
name: "Deny log on through Terminal Services"
value: "Guests"
</item>
The report shows the following
"Denied Logon Through Terminal Services" : [FAILED]
Remote value: "guests" | "renamed_guest"
Policy value: "Guests"
As per the FDCC guideline "Deny logon through Terminal Services" should only
be denied to "Guests". The
FDCC checks within the .audit files are so designed, that they will pass
only if the settings on the remote system are "exactly" the same as
recommended
by the FDCC guideline. We have tested these against Virtual hard disks
published by NIST on the CSRC-FDCC website and can be downloaded from the
link below :
http://fdcc.nist.gov/download_fdcc.html
We have also published the results of our scan on our blog :
http://blog.tenablesecurity.com/2007/09/using-nessus-co.html
Is there a way that check can be written to look for "Guests"
, but not fail if I place addational restrict on other groups
or users?
Not at this time, but our future version of compliance checks will be able
support this kind of operation. We expect to release it in Q1 next year.
- Mehul
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus
