[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1389
  • Last Modified:

Bypass Traverse Checking Security

Can someone please tell me if Backup Operators and Users groups actually need to be given this right?  We follow DISA Stigs and this was a finding.  We need to know if they can be removed safely and if not, sound justification.  Thanks in advance.
0
BrianRB
Asked:
BrianRB
  • 3
  • 2
2 Solutions
 
Mike KlineCommented:
It should give you some performance gains on long/deep folders, because the account can traverse the path.  Having said that I don't have stats to know how noticeable the gain would be.

Is this a CAT I, II, or III finding (for those not familiar with the DISA stigs CAT1 is most critical)

Thanks

Mike
0
 
BrianRBAuthor Commented:
3 I believe.  I'll confirm.  Do you see why Backup Ops and the users groups need to be added?
0
 
Mike KlineCommented:
I could see the case for backup ops as accounts used to backup do have to go through the entire directory.
0
Get your Disaster Recovery as a Service basics

Disaster Recovery as a Service is one go-to solution that revolutionizes DR planning. Implementing DRaaS could be an efficient process, easily accessible to non-DR experts. Learn about monitoring, testing, executing failovers and failbacks to ensure a "healthy" DR environment.

 
BrianRBAuthor Commented:
V-26475      STIG.DOD.MIL      WINUR-000008      Automated      CAT III      Unauthorized accounts will not have the "Bypass traverse checking" user right      "Inappropriate granting of user rights can provide system, administrative, and other high level capabilities.

Accounts with the ""Bypass traverse checking"" right can pass through folders when browsing even if they do not have the Traverse Folder access permission. They could potentially view sensitive file and folder names. They would not have additional access to the files and folders unless it is granted through permissions"      "Analyze the system using the Security Configuration and Analysis snap-in.
Expand the Security Configuration and Analysis tree view.
Navigate to Local Policies -> User Rights Assignment.

If any accounts or groups other than the following are granted the “Bypass traverse checking” right, this is a finding:

Administrators
Authenticated Users
Local Service
Network Service"
0
 
Adam BrownSr Solutions ArchitectCommented:
Heh. That's hilarious. It's barking about the Backup Operators group having Bypass Traverse checking, but that explanation says it's okay for the Authenticated Users group to have it. That means everyone is going to have it anyway.

Generally it's safe to remove the Bypass right from the Backup Operators group, particularly if it is already assigned to the Authenticated Users group. Again, if you're not using the Backup Operators group, this finding is mostly mitigated by that. The end result of removing the right from that group is that backup processes that use accounts in the Backup Operators group for authentication (not particularly common) will not be able to read the entire file structure if they are not granted permission to do so. This will affect those backups. It's generally a better idea to configure backup services to run using the local service or a highly secured specialized administrative account with no local or remote login rights.
0
 
BrianRBAuthor Commented:
You guys are the best.  Thx.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now