Remote calls to the Security Account Manager (SAM) must be restricted to Administrators.
An XCCDF Rule
Description
The Windows Security Account Manager (SAM) stores users' passwords. Restricting Remote Procedure Call (RPC) connections to the SAM to Administrators helps protect those credentials.
- ID
- SV-225013r958726_rule
- Version
- WN16-MS-000310
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Navigate to the policy Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Network access: Restrict clients allowed to make remote calls to SAM".
Select "Edit Security" to configure the "Security descriptor:".
Add "Administrators" in "Group or user names:" if it is not already listed (this is the default).