FDCC_Desktops_v90.audit files Question

The follow question was sent to NIST

The GPOs from the NIST site have the following settings: NewAdministratorName = 
"Renamed_Admin" and 
NewGuestName = "Renamed_Guest"  If all Gov't agencies implement the GPOs 
without modifying them,  all the workstations in the Gov't will have the same 
account names for guest   and admin.  Can we change those security options to 
match the agencies security policy?

NIST reply
From: 
Sent: Thursday, November 29, 2007 7:55 AM
To: 
Cc: fdcc@nist.gov
Subject: Re: FDCC Group Policy Files

That has always been the objective of those settings.  The default  accounts 
should be renamed and documented in the organization policy.

NIST

The FDCC_Desktops_v90.audit files check for the Renamed_Admin and Renamed_Guest 
 only and will generate errors. A better check would be to enumerate the SID 
for the Guest and Administrator account, then check the name.

<custom_item>
     type: CHECK_ACCOUNT
    description: "Accounts: Rename Administrator account"
    value_type: POLICY_TEXT
    value_data: "Renamed_Admin"
    account_type: ADMINISTRATOR_ACCOUNT
    account_option: ACCOUNT_EQUAL
</item>

<custom_item>
  type: CHECK_ACCOUNT
  description: "Accounts: Rename guest account"
  value_type: POLICY_TEXT
  value_data: "Renamed_Guest"
  account_type: GUEST_ACCOUNT
  account_option: ACCOUNT_EQUAL
</item>

 
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus