Microsoft Windows Server 2022

Windows Server 2022 Event Viewer must be protected from unauthorized modification and deletion

STIG ID: WN22-AU-000060 |   SRG: SRG-OS-000257-GPOS-00098 |   Severity: Medium |   CCI: CCI-001494,CCI-001495 |   Vulnerability ID: V-254299

Description

Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit information.Operating systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys to make access decisions regarding the modification or deletion of audit tools.Satisfies: SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099

Check

C-57784r951103_chk

This is not applicable for Windows Core Edition.Navigate to "%SystemRoot%\System32".View the permissions on "Eventvwr.exe".If any groups or accounts other than TrustedInstaller have "Full control" or "Modify" permissions, this is a finding.The default permissions below satisfy this requirement:TrustedInstaller - Full ControlAdministrators, SYSTEM, Users, ALL APPLICATION PACKAGES, ALL RESTRICTED APPLICATION PACKAGES - Read & Execute

Fix

F-57735r848712_fix

Configure the permissions on the "Eventvwr.exe" file to prevent modification by any groups or accounts other than TrustedInstaller. The default permissions listed below satisfy this requirement:TrustedInstaller - Full ControlAdministrators, SYSTEM, Users, ALL APPLICATION PACKAGES, ALL RESTRICTED APPLICATION PACKAGES - Read & ExecuteThe default location is the "%SystemRoot%\System32" folder.