2.2.24 (L1) Ensure 'Impersonate a client after authentication' is set to 'Administrators, LOCAL SER

2.2.24 (L1) Ensure 'Impersonate a client after authentication' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE' (Automated)

Description

Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they've created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels.

UserRights Policy CSP - Windows Client ManagementMicrosoftLearn

OMA-URI

./Device/Vendor/MSFT/Policy/Config/UserRights/ImpersonateClient

Recommended Setting

Format: chr (string) Value: Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE

Settings Catalog

YES

User Rights

Impersonate Client