Systems must be monitored for remote desktop logons.

From Active Directory Domain Security Technical Implementation Guide (STIG)

Associated with: CCI-000366

SV-56535r3_rule Systems must be monitored for remote desktop logons.

Vulnerability discussion

Remote Desktop activity for administration should be limited to specific administrators, and from limited management workstations. Monitoring for any Remote Desktop logins outside of expected activity can alert on suspicious behavior and anomalous account usage that could be indicative of potential malicious credential reuse.

Check content

Verify Remote Desktop logins are being monitored. Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools. Monitor for the events listed below. If these events are not monitored, this is a finding. More advanced filtering is necessary to obtain the pertinent information than just looking for event IDs. Search for the event IDs listed with the following additional attributes: Logon Type = 10 (RemoteInteractive) Authentication Package Name = Negotiate Successful User Account Login (Subcategory: Logon) 4624 - An account was successfully logged on.

Fix text

More advanced filtering is necessary to obtain the pertinent information than just looking for event IDs. Search for the event IDs listed with the following additional attributes: Logon Type = 10 (RemoteInteractive) Authentication Package Name = Negotiate Successful User Account Login (Subcategory: Logon) 4624 - An account was successfully logged on. The "Remote Desktop Logon Detection" section of NSA's "Spotting the Adversary with Windows Event Log Monitoring" provides a sample query for filtering. http://www.nsa.gov/ia/_files/app/Spotting_the_Adversary_with_Windows_Event_Log_Monitoring.pdf.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.