[Forgot Password]
Login  Register Subscribe

30479

 
 

423868

 
 

248392

 
 

909

 
 

195452

 
 

282

Paid content will be excluded from the download.


Download | Alert*
CCE
view XML

CCE-47743-0

Platform: cpe:/o:microsoft:windows_server_2016Date: (C)2022-09-02   (M)2023-07-04



This policy setting lets you capture the input and output of Windows PowerShell commands into text-based transcripts. If you enable this policy setting, Windows PowerShell will enable transcripting for Windows PowerShell, the Windows PowerShell ISE, and any otherapplications that leverage the Windows PowerShell engine. By default, Windows PowerShell will record transcript output to each users' My Documentsdirectory, with a file name that includes 'PowerShell_transcript', along with the computer name and time started. Enabling this policy is equivalentto calling the Start-Transcript cmdlet on each Windows PowerShell session. If you disable this policy setting, transcripting of PowerShell-based applications is disabled by default, although transcripting can still be enabledthrough the Start-Transcript cmdlet.If you use the OutputDirectory setting to enable transcript logging to a shared location, be sure to limit access to that directory to prevent usersfrom viewing the transcripts of other users or computers. Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting.Fix:(1) GPO: Computer ConfigurationAdministrative TemplatesWindows ComponentsWindows PowerShellTurn on PowerShell Transcription(2) REG: HKEY_LOCAL_MACHINE or HKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsPowerShellTranscription!EnableTranscripting


Parameter:

[enabled/disabled]


Technical Mechanism:

(1) GPO: Computer Configuration\Administrative Templates\Windows Components\Windows PowerShell\Turn on PowerShell Transcription (2) REG: HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription!EnableTranscripting

CCSS Severity:CCSS Metrics:
CCSS Score : 3.3Attack Vector: LOCAL
Exploit Score: 1.8Attack Complexity: LOW
Impact Score: 1.4Privileges Required: LOW
Severity: LOWUser Interaction: NONE
Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NScope: UNCHANGED
 Confidentiality: LOW
 Integrity: NONE
 Availability: NONE
  

References:
Resource IdReference
SCAP Repo OVAL Definitionoval:org.secpod.oval:def:83677


OVAL    1
oval:org.secpod.oval:def:83677
XCCDF    1
xccdf_org.secpod_benchmark_general_Windows_Server_2016

© SecPod Technologies