8b1ee75d-b328-42df-a89e-18d9b6249601
Inappropriately granting user rights provides system, administrative, and other high-level capabilities.
The "Deny log on as a batch job" user right defines accounts that are prevented from logging on to the system as a batch job, such as Task Scheduler.
The Guests group must be assigned to prevent unauthenticated access.
To fix this configure the policy value for
Computer Configuration
|_ Windows Settings
|_ Security Settings
|_ Local Policies
|_ User Rights Assignment
|_ Deny log on as a batch job to include the following:
- Guests Group
STIG: Server
2025: https://system32.eventsentry.com/stig/viewer/V-278169
2022: https://system32.eventsentry.com/stig/viewer/V-254422
2019: https://system32.eventsentry.com/stig/viewer/V-205668
2016: https://system32.eventsentry.com/stig/viewer/V-225001
NIST 800-53 : AC-3, AC-6, CM-6
NIST 800-171: 3.1.1, 3.1.2, 3.4.6
CMMC v2.0 L2: AC.L2-3.1.1, AC.L2-3.1.2, CM.L2-3.4.6
PCI-DSS v4.0: 2.2.1, 7.2.1
HIPAA SR : ยง164.312(a)(1)
HIPAA HICP : Practice 3 (Identity and Access Management)
Manage your cookie preferences below:
To learn more about our use of cookies, please see our
Privacy Policy.