CCE-2886-0| Platform: cpe:/o:microsoft:windows_xp | Date: (C)2012-03-13 (M)2023-07-04 |
This policy setting allows users to shut down Windows Vista-based computers from remote locations on the network. Anyone who has been assigned this user right can cause a denial of service (DoS) condition, which would make the computer unavailable to service user requests. Therefore, Microsoft recommends that only highly trusted administrators be assigned this user right.
Countermeasure:
Restrict the Force shutdown from a remote system user right to members of the Administrators group or other specifically assigned roles that require this capability (such as non-administrative operations center staff).
Potential Impact:
If you remove the Force shutdown from a remote system user right from the Server Operator group you could limit the abilities of users who are assigned to specific administrative roles in your environment. You should confirm that delegated activities will not be adversely affected.
Parameter:
[list_of_users_followed_by_comma]
Technical Mechanism:
(1) GPO: Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment\\Force shutdown from a remote system
(2) REG: ###
(3) WMI: root\\rsop\\computer#RSOP_UserPrivilegeRight#AccountList#UserRight='SeRemoteShutdownPrivilege' and precedence=1
| CCSS Severity: | CCSS Metrics: |
| CCSS Score : 6.5 | Attack Vector: NETWORK |
| Exploit Score: 2.8 | Attack Complexity: LOW |
| Impact Score: 3.6 | Privileges Required: LOW |
| Severity: MEDIUM | User Interaction: NONE |
| Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | Scope: UNCHANGED |
| | Confidentiality: NONE |
| | Integrity: NONE |
| | Availability: HIGH |
| | |
References: | Resource Id | Reference |
|---|
| SCAP Repo OVAL Definition | oval:gov.nist.usgcb.xp:def:180 |
| BITS Shared Assessments SIG v6.0 | BITS Shared Assessments SIG v6.0 |
| Jericho Forum | Jericho Forum |
| HIPAA/HITECH Act | HIPAA/HITECH Act |
| FedRAMP Security Controls(Final Release Jan 2012)--LOW IMPACT LEVEL-- | FedRAMP Security Controls(Final Release Jan 2012)--LOW IMPACT LEVEL-- |
| ISO/IEC 27001-2005 | ISO/IEC 27001-2005 |
| COBIT 4.1 | COBIT 4.1 |
| GAPP (Aug 2009) | GAPP (Aug 2009) |
| NERC CIP | NERC CIP |
| NIST SP800-53 R3 | NIST SP800-53 R3 AC-3 |
| NIST SP800-53 R3 | NIST SP800-53 R3 CM-6 |
| PCIDSS v2.0 | PCIDSS v2.0 |
| FedRAMP Security Controls(Final Release Jan 2012)--MODERATE IMPACT LEVEL-- | FedRAMP Security Controls(Final Release Jan 2012)--MODERATE IMPACT LEVEL-- |
| BITS Shared Assessments AUP v5.0 | BITS Shared Assessments AUP v5.0 |
