Details

This is a Category 1 finding because if this option is set, the Recovery Console does not require you to provide a password and will automatically log on to the system, giving Administrator access to system files.

By default, the Recovery Console requires you to provide the password for the Administrator account before accessing the system.

Solution

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> ‘Recovery Console- Allow automatic administrative logon’ to ‘Disabled’.

Supportive Information

The following resource is also helpful.

• http://iasecontent.disa.mil/stigs/zip/Oct2016/U_Windows_Vista_V6R41_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Windows.

References

• 800-53|CM-6b.
• CAT|I
• CCI|CCI-000366
• Rule-ID|SV-29023r1_rule
• STIG-ID|3.049
• Vuln-ID|V-1159

Source

• Tenable.com/audits