The system is configured to allow unsolicited remote assistance offers.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3470	3.082	SV-3470r1_rule	ECSC-1	Medium

Description
This setting controls whether unsolicited offers of help to this computer are allowed. The list of users allowed to offer remote assistance to this system is accessed by pressing the Helpers button.

STIG	Date
Windows XP Security Technical Implementation Guide	2012-08-22

Details

Check Text ( C-32863r1_chk )
If the following registry value doesn’t exist or is not configured as specified this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ Value Name: fAllowUnsolicited Type: REG_DWORD Value: 0 Documentable: Yes Documentable Explanation: Offer remote assistance can be enabled on workstations if mitigations are in place. This must be documented with the IAO. Mitigations: -Users must be trained to include the following: -Who they can accept assistance offer from. Offer must be in response to help desk request or confirmed with help desk if unsolicited offer comes through. -Users must know how to accept request, allow view or control, and how to disconnect a remote assistance session. -Users needs monitor the assistance activity at the workstation while it is occurring. -The support personnel allowed to offer assistance (helpers) must be limited and documented. -Port 3389 should be blocked at the perimeter to prevent other access. Accounts and groups authorized to offer remote assistance (helpers) are identified in the following registry key. Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ RAUnsolicit\ Each Account or group will be listed under a separate value name with the value equaling the value name as in the following examples. Value Name: Administrators Type: REG_SZ Value: Administrators Value Name: TestUser Type: REG_SZ Value: TestUser

Check Text ( C-32863r1_chk )

If the following registry value doesn’t exist or is not configured as specified this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\

Value Name: fAllowUnsolicited

Type: REG_DWORD
Value: 0

Documentable: Yes
Documentable Explanation: Offer remote assistance can be enabled on workstations if mitigations are in place. This must be documented with the IAO.

Mitigations:
-Users must be trained to include the following:
-Who they can accept assistance offer from. Offer must be in response to help desk request or confirmed with help desk if unsolicited offer comes through.
-Users must know how to accept request, allow view or control, and how to disconnect a remote assistance session.
-Users needs monitor the assistance activity at the workstation while it is occurring.

-The support personnel allowed to offer assistance (helpers) must be limited and documented.

-Port 3389 should be blocked at the perimeter to prevent other access.

Accounts and groups authorized to offer remote assistance (helpers) are identified in the following registry key.

Registry Hive: HKEY_LOCAL_MACHINE
Subkey: \Software\Policies\Microsoft\Windows NT\Terminal Services\ RAUnsolicit\

Each Account or group will be listed under a separate value name with the value equaling the value name as in the following examples.

Value Name: Administrators
Type: REG_SZ
Value: Administrators

Value Name: TestUser
Type: REG_SZ
Value: TestUser

Fix Text (F-6776r1_fix)
Configure the system to prevent unsolicited remote assistance offers by setting the policy value for Computer Configuration -> Administrative Templates -> System -> Remote Assistance “Offer Remote Assistance” to “Disabled”.