CCI-002235
Prevent non-privileged users from executing privileged functions.
4 rules found Severity: Medium
A policy set using the built-in role-based access control (RBAC) capabilities in the Universal Control Plane (UCP) component of Docker Enterprise must be configured.
1 rule found Severity: Medium
A policy set using the built-in role-based access control (RBAC) capabilities in the Docker Trusted Registry (DTR) component of Docker Enterprise must be set.
1 rule found Severity: Medium
Google Android 12 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)].
2 rules found Severity: Medium
DB2 must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: High
1 rule found Severity: Medium
The WebSphere Application Server users in a LDAP user registry group must be authorized for that group.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The IBM z/VM Privilege Class F must be restricted to service representatives and system administrators only.
1 rule found Severity: Medium
1 rule found Severity: Medium
Microsoft Android 11 must be configured to enable encryption for data at rest on removable storage media or alternately, the use of removable storage media must be disabled.
2 rules found Severity: High
The mobile operating system must allow only the Administrator (MDM) to perform the following management function: Enable/disable location services.
2 rules found Severity: Low
SQL Server must prevent non-privileged users from executing privileged functionality, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
Nutanix AOS must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
Non-privileged accounts on the hosting system must only access OHS security-relevant information and functions through a distinct administrative account.
1 rule found Severity: Medium
All Active Directory accounts synchronized with Tanium for non-privileged functions must be non-privileged domain accounts.
2 rules found Severity: Medium
The macOS system must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
2 rules found Severity: Medium
Pam_Apparmor must be configured to allow system administrators to pass information to any other Ubuntu operating system administrator or user, change security attributes, and to confine all non-privileged users from executing functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Low
MongoDB must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects.
2 rules found Severity: Medium
PostgreSQL must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
2 rules found Severity: High
The Red Hat Enterprise Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values.
1 rule found Severity: High
The Red Hat Enterprise Linux operating system must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
The Red Hat Enterprise Linux operating system must confine SELinux users to roles that conform to least privilege.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Red Hat Enterprise Linux operating system must elevate the SELinux context when an administrator calls the sudo command.
1 rule found Severity: Medium
Samsung Android must be configured to enable encryption for data at rest on removable storage media or, alternately, the use of removable storage media must be disabled.
8 rules found Severity: High
The EDB Postgres Advanced Server must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
IDMS must prevent users without the appropriate access from executing privileged functions or tasks within the IDMS environment.
1 rule found Severity: Medium
IDMS must prevent unauthorized users from executing certain privileged commands that can be used to change the runtime IDMS environment.
1 rule found Severity: Medium
IDMS must protect its user catalogs and system dictionaries to prevent unauthorized users from bypassing or updating security settings.
1 rule found Severity: Medium
PostgreSQL must prevent nonprivileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
The Cisco ISE must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: High
The EDB Postgres Advanced Server must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
SSMC must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Distributed Console Access Facility (DCAF) Console must be restricted to only authorized personnel.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: High
The application server must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
2 rules found Severity: Medium
The Juniper EX switch must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: High
MarkLogic Server must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
MongoDB must prevent nonprivileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
Azure SQL Database must prevent nonprivileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
1 rule found Severity: Medium
3 rules found Severity: Medium
3 rules found Severity: Medium
The "Access Credential Manager as a trusted caller" user right must not be assigned to any groups or accounts.
1 rule found Severity: Medium
The "Act as part of the operating system" user right must not be assigned to any groups or accounts.
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
The "Create global objects" user right must only be assigned to Administrators, Service, Local Service, and Network Service.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
The "Enable computer and user accounts to be trusted for delegation" user right must not be assigned to any groups or accounts.
1 rule found Severity: Medium
The "Force shutdown from a remote system" user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
The "Impersonate a client after authentication" user right must only be assigned to Administrators, Service, Local Service, and Network Service.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The "Modify firmware environment values" user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
The "Perform volume maintenance tasks" user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
The "Take ownership of files or other objects" user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
Only administrators responsible for the domain controller must have Administrator rights on the system.
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: High
The Active Directory Domain Controllers Organizational Unit (OU) object must have the proper access control permissions.
1 rule found Severity: High
Domain-created Active Directory Organizational Unit (OU) objects must have proper access control permissions.
1 rule found Severity: High
1 rule found Severity: Medium
The Enable computer and user accounts to be trusted for delegation user right must only be assigned to the Administrators group on domain controllers.
1 rule found Severity: Medium
Only administrators responsible for the member server or standalone or nondomain-joined system must have Administrator rights on the system.
1 rule found Severity: High
The "Enable computer and user accounts to be trusted for delegation" user right must not be assigned to any groups or accounts on member servers.
1 rule found Severity: Medium
The Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.
2 rules found Severity: Medium
2 rules found Severity: High
2 rules found Severity: Medium
2 rules found Severity: Medium
The Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: High
The Force shutdown from a remote system user right must only be assigned to the Administrators group.
2 rules found Severity: Medium
1 rule found Severity: Medium
The Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.
2 rules found Severity: Medium
1 rule found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
The Modify firmware environment values user right must only be assigned to the Administrators group.
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: Medium
2 rules found Severity: High
2 rules found Severity: Medium
The Take ownership of files or other objects user right must only be assigned to the Administrators group.
2 rules found Severity: Medium
The network device must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: High
ONTAP must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: High
The Oracle Linux operating system must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
The Oracle Linux operating system must confine SELinux users to roles that conform to least privilege.
1 rule found Severity: Medium
1 rule found Severity: Medium
The Oracle Linux operating system must elevate the SELinux context when an administrator calls the sudo command.
1 rule found Severity: Medium
The MySQL Database Server 8.0 must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
Redis Enterprise DBMS must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
Nonprivileged accounts on the hosting system must only access Automation Controller NGINX web server security-relevant information and functions through a distinct administrative account.
1 rule found Severity: Medium
1 rule found Severity: High
The TippingPoint SMS must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access and to enforce access restrictions.
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
Non-privileged accounts on the hosting system must only access web server security-relevant information and functions through a distinct administrative account.
1 rule found Severity: Medium
1 rule found Severity: High
Non-privileged accounts on the hosting system must only access Apache web server security-relevant information and functions through a distinct administrative account.
3 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: High
The application must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: Medium
AlmaLinux OS 9 must enable kernel parameters to enforce discretionary access control (DAC) on symlinks.
1 rule found Severity: Medium
The container platform must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
The DBMS must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
1 rule found Severity: High
The Dell OS10 Switch must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: High
Google Android 13 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)].
2 rules found Severity: Medium
Google Android 14 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)].
2 rules found Severity: Medium
Google Android 15 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)].
2 rules found Severity: Medium
The operating system must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: High
1 rule found Severity: Medium
3 rules found Severity: High
1 rule found Severity: High
CA-ACF2 must limit Write or greater access to SYS1.UADS To system programmers only and read and update access must be limited to system programmer personnel and/or security personnel.
1 rule found Severity: High
1 rule found Severity: High
3 rules found Severity: Medium
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: High
IBM RACF must limit Write or greater access to libraries that contain PPT modules to system programmers only.
1 rule found Severity: Low
1 rule found Severity: High
IBM RACF must limit Write or greater access to SYS1.UADS to system programmers only, and WRITE or greater access must be limited to system programmer personnel and/or security personnel.
1 rule found Severity: High
1 rule found Severity: Medium
IBM RACF must limit WRITE or greater access to System backup files to system programmers and/or batch jobs that perform DASD backups.
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: High
CA-ACF2 must limit Write or greater access to Libraries containing EXIT modules to system programmers only.
1 rule found Severity: High
CA-ACF2 must limit Write and Allocate access to all APF-authorized libraries to system programmers only.
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: Medium
CA-ACF2 must limit Write and allocate access to all system-level product installation libraries to system programmers only.
1 rule found Severity: Medium
1 rule found Severity: High
CA-ACF2 must limit access to data sets used to back up and/or dump SMF collection files to appropriate users and/or batch jobs that perform SMF dump processing.
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: Medium
CA-ACF2 must limit Update and Allocate access to system backup files to system programmers and/or batch jobs that perform DASD backups.
1 rule found Severity: Medium
ACF2 PPGM GSO record value must specify protected programs that are only executed by privileged users.
1 rule found Severity: Medium
CA-ACF2 must limit Write and allocate access to the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) to system programmers only.
1 rule found Severity: Medium
CA-ACF2 must limit Write or greater access to libraries that contain PPT modules to system programmers only.
1 rule found Severity: Low
IBM z/OS SMF collection files (i.e., SYS1.MANx) access must be limited to appropriate users and/or batch jobs that perform SMF dump processing.
1 rule found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: High
2 rules found Severity: High
1 rule found Severity: High
IBM RACF must limit Write or greater access to libraries containing EXIT modules to system programmers only.
1 rule found Severity: High
IBM RACF must limit WRITE or greater access to all system-level product installation libraries to system programmers.
1 rule found Severity: Medium
1 rule found Severity: Medium
IBM RACF must limit WRITE or greater access to all APF-authorized libraries to system programmers only.
1 rule found Severity: High
1 rule found Severity: High
IBM RACF must limit access to data sets used to back up and/or dump SMF collection files to appropriate users and/or batch jobs that perform SMF dump processing.
1 rule found Severity: Medium
1 rule found Severity: High
IBM RACF must limit access to System page data sets (i.e., PLPA, COMMON, and LOCALx) to system programmers.
1 rule found Severity: Medium
IBM RACF must limit WRITE or greater access to the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) to system programmers only.
1 rule found Severity: Medium
2 rules found Severity: Medium
IBM z/OS must limit access for SMF collection files (i.e., SYS1.MANx) to appropriate users and/or batch jobs that perform SMF dump processing.
2 rules found Severity: Medium
3 rules found Severity: Medium
3 rules found Severity: Medium
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: High
CA-TSS must limit WRITE or greater access to all APF-authorized libraries to system programmers only.
1 rule found Severity: High
1 rule found Severity: High
1 rule found Severity: High
CA-TSS must limit Write or greater access to libraries that contain PPT modules to system programmers only.
1 rule found Severity: Low
1 rule found Severity: Medium
1 rule found Severity: High
CA-TSS must limit WRITE or greater access to all system-level product installation libraries to system programmers only.
1 rule found Severity: Medium
CA-TSS must limit WRITE or greater access to the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) to system programmers only.
1 rule found Severity: Medium
CA-TSS must limit Write or greater access to SYS1.UADS to system programmers only, and Read and Update access must be limited to system programmer personnel and/or security personnel.
1 rule found Severity: High
CA-TSS must limit access to data sets used to back up and/or dump SMF collection files to appropriate users and/or batch jobs that perform SMF dump processing.
1 rule found Severity: Medium
1 rule found Severity: Medium
CA-TSS WRITE or Greater access to System backup files must be limited to system programmers and/or batch jobs that perform DASD backups.
1 rule found Severity: Medium
CA-TSS must limit access to System page data sets (i.e., PLPA, COMMON, and LOCALx) to system programmers only.
1 rule found Severity: Medium
CA-TSS must limit WRITE or greater access to libraries containing EXIT modules to system programmers only.
1 rule found Severity: High
CA-TSS must limit all system PROCLIB data sets to system programmers only and appropriate authorized users.
1 rule found Severity: High
1 rule found Severity: Medium
The Mainframe Product must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
MariaDB must prevent nonprivileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
2 rules found Severity: Medium
1 rule found Severity: Medium
1 rule found Severity: Medium
SharePoint must prevent non-privileged users from circumventing malicious code protection capabilities.
1 rule found Severity: High
SQL Server must prevent non-privileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
Only accounts responsible for the administration of a system must have Administrator rights on the system.
1 rule found Severity: High
Windows Server 2019 default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.
1 rule found Severity: Medium
Windows Server 2019 must only allow administrators responsible for the domain controller to have Administrator rights on the system.
1 rule found Severity: High
Windows Server 2019 permissions on the Active Directory data files must only allow System and Administrators access.
1 rule found Severity: High
Windows Server 2019 Active Directory SYSVOL directory must have the proper access control permissions.
1 rule found Severity: High
Windows Server 2019 Active Directory Group Policy objects must have proper access control permissions.
1 rule found Severity: High
Windows Server 2019 Active Directory Domain Controllers Organizational Unit (OU) object must have the proper access control permissions.
1 rule found Severity: High
Windows Server 2019 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions.
1 rule found Severity: High
Windows Server 2019 Add workstations to domain user right must only be assigned to the Administrators group on domain controllers.
1 rule found Severity: Medium
Windows Server 2019 Enable computer and user accounts to be trusted for delegation user right must only be assigned to the Administrators group on domain controllers.
1 rule found Severity: Medium
Windows Server 2019 must only allow Administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system.
1 rule found Severity: High
Windows Server 2019 must restrict remote calls to the Security Account Manager (SAM) to Administrators on domain-joined member servers and standalone or nondomain-joined systems.
1 rule found Severity: Medium
Windows Server 2019 "Enable computer and user accounts to be trusted for delegation" user right must not be assigned to any groups or accounts on domain-joined member servers and standalone or nondomain-joined systems.
1 rule found Severity: Medium
Windows Server 2019 Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.
1 rule found Severity: Medium
Windows Server 2019 Act as part of the operating system user right must not be assigned to any groups or accounts.
1 rule found Severity: High
Windows Server 2019 Back up files and directories user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
1 rule found Severity: Medium
Windows Server 2019 Create a token object user right must not be assigned to any groups or accounts.
1 rule found Severity: High
Windows Server 2019 Create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.
1 rule found Severity: Medium
The Change the system time user right must only be assigned to Administrators and Local Service and NT SERVICE\autotimesvc.
1 rule found Severity: Medium
Windows Server 2019 Create permanent shared objects user right must not be assigned to any groups or accounts.
1 rule found Severity: Medium
Windows Server 2019 Create symbolic links user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
1 rule found Severity: High
Windows Server 2019 Force shutdown from a remote system user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
Windows Server 2019 Generate security audits user right must only be assigned to Local Service and Network Service.
1 rule found Severity: Medium
Windows Server 2019 Impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.
1 rule found Severity: Medium
Windows Server 2019 Increase scheduling priority: user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
Windows Server 2019 Load and unload device drivers user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
1 rule found Severity: Medium
Windows Server 2019 Modify firmware environment values user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
Windows Server 2019 Perform volume maintenance tasks user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
Windows Server 2019 Profile single process user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
Windows Server 2019 Restore files and directories user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
Windows Server 2019 Take ownership of files or other objects user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
The Enable computer and user accounts to be trusted for delegation user right must not be assigned to any groups or accounts.
1 rule found Severity: Medium
Windows Server 2022 default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.
1 rule found Severity: Medium
Windows Server 2022 must only allow administrators responsible for the domain controller to have Administrator rights on the system.
1 rule found Severity: High
Windows Server 2022 permissions on the Active Directory data files must only allow System and Administrators access.
1 rule found Severity: High
Windows Server 2022 Active Directory SYSVOL directory must have the proper access control permissions.
1 rule found Severity: High
Windows Server 2022 Active Directory Group Policy objects must have proper access control permissions.
1 rule found Severity: High
Windows Server 2022 Active Directory Domain Controllers Organizational Unit (OU) object must have the proper access control permissions.
1 rule found Severity: High
Windows Server 2022 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions.
1 rule found Severity: High
Windows Server 2022 Add workstations to domain user right must only be assigned to the Administrators group on domain controllers.
1 rule found Severity: Medium
Windows Server 2022 Enable computer and user accounts to be trusted for delegation user right must only be assigned to the Administrators group on domain controllers.
1 rule found Severity: Medium
Windows Server 2022 must only allow administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system.
1 rule found Severity: High
Windows Server 2022 must restrict remote calls to the Security Account Manager (SAM) to Administrators on domain-joined member servers and standalone or nondomain-joined systems.
1 rule found Severity: Medium
Windows Server 2022 Enable computer and user accounts to be trusted for delegation user right must not be assigned to any groups or accounts on domain-joined member servers and standalone or nondomain-joined systems.
1 rule found Severity: Medium
Windows Server 2022 Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.
1 rule found Severity: Medium
Windows Server 2022 Act as part of the operating system user right must not be assigned to any groups or accounts.
1 rule found Severity: High
Windows Server 2022 back up files and directories user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
1 rule found Severity: Medium
Windows Server 2022 create a token object user right must not be assigned to any groups or accounts.
1 rule found Severity: High
Windows Server 2022 create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.
1 rule found Severity: Medium
Windows Server 2022 create permanent shared objects user right must not be assigned to any groups or accounts.
1 rule found Severity: Medium
Windows Server 2022 create symbolic links user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
1 rule found Severity: High
Windows Server 2022 force shutdown from a remote system user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
Windows Server 2022 generate security audits user right must only be assigned to Local Service and Network Service.
1 rule found Severity: Medium
Windows Server 2022 impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.
1 rule found Severity: Medium
Windows Server 2022 increase scheduling priority: user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
Windows Server 2022 load and unload device drivers user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
1 rule found Severity: Medium
Windows Server 2022 modify firmware environment values user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
Windows Server 2022 perform volume maintenance tasks user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
Windows Server 2022 profile single process user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
Windows Server 2022 restore files and directories user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
Windows Server 2022 take ownership of files or other objects user right must only be assigned to the Administrators group.
1 rule found Severity: Medium
Users requiring access to Prisma Cloud Compute's Credential Store must be assigned and accessed by the appropriate role holders.
1 rule found Severity: Medium
Rancher RKE2 must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
OL 8 must prevent nonprivileged users from executing privileged functions, including disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
1 rule found Severity: High
1 rule found Severity: Medium
1 rule found Severity: Medium
The SUSE operating system Apparmor tool must be configured to control whitelisted applications and user home directory access control.
1 rule found Severity: Medium
SUSE operating system AppArmor tool must be configured to control whitelisted applications and user home directory access control.
1 rule found Severity: Medium
The operating system must prevent non-privileged users from circumventing malicious code protection capabilities.
2 rules found Severity: Medium
The Samsung Android device must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)].
4 rules found Severity: Medium
The system must restrict the ability of users to assume excessive privileges to members of a defined group and prevent unauthorized users from accessing administrative tools.
1 rule found Severity: Medium
The NSX Manager must assign users/accounts to organization-defined roles configured with approved authorizations.
1 rule found Severity: High
The VMM must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
1 rule found Severity: Medium
2 rules found Severity: High
Zebra Android 13 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)].
2 rules found Severity: Medium
1 rule found Severity: Medium
NSX-T Manager must restrict the use of configuration, administration, and the execution of privileged commands to authorized personnel based on organization-defined roles.
1 rule found Severity: High
Rancher MCM must use a centralized user management solution to support account management functions. For accounts using password authentication, the container platform must use FIPS-validated SHA-2 or later protocol to protect the integrity of the password authentication process.
1 rule found Severity: High