The Recycle Bin on a server must be configured to immediately delete files.

From Windows 2008 Member Server Security Technical Implementation Guide

Associated with: CCI-000366

SV-16948r2_rule The Recycle Bin on a server must be configured to immediately delete files.

Vulnerability discussion

The Recycle Bin saves a copy of a file when it is deleted. A deleted file may contain sensitive data, subjecting that data to potential exposure.

Check content

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoRecycleFiles Type: REG_DWORD Value: 1 If this is configured in the Recycle Bin Properties instead of through a policy verify the following: Right Click the Recycle Bin and select Properties. Select each Recycle Bin Location. Verify that "Do not move files to the Recycle Bin. Remove files immediately when deleted." is selected. If any of the drives are not configured to delete files immediately, this is a finding.

Fix text

Configure the policy value for User Configuration -> Administrative Templates -> Windows Components -> Windows Explorer -> "Do not move deleted files to the Recycle Bin" to "Enabled". Or Select "Do not move files to the Recycle Bin. Remove files immediately when deleted." for each volume in the Recycle Bin Properties.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.