Remote Assistance and Remote Management¶
Two more ways into a Windows machine over the network, both separate from Remote Desktop, plus the RPC plumbing underneath most remote management.
Remote Assistance¶
Lets someone take control of a logged-in user's session to "help." Unless the README says a help desk uses it, turn it off, and enforce it by policy so it stays off.
gpedit.msc → Computer Configuration → Administrative Templates → System → Remote Assistance:
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 18.9.37.1 | Configure Offer Remote Assistance | Disabled | Nobody can offer to connect unprompted |
| 18.9.37.2 | Configure Solicited Remote Assistance | Disabled | Users can't send invitations either |
GUI alternative: Control Panel → System → Remote settings → untick Allow Remote Assistance connections to this computer.
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fAllowUnsolicited /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fAllowToGetHelp /t REG_DWORD /d 0 /f
Also remove the firewall exception: Windows Security → Firewall & network protection → Allow an app through firewall → untick Remote Assistance.
Windows Remote Management (WinRM)¶
PowerShell remoting. On Server 2022 it's on by default because Server Manager uses it. On a workstation it's usually off.
Level 1: harden it¶
Even where WinRM stays on, it should never accept weak authentication or send anything unencrypted. gpedit.msc → Administrative Templates → Windows Components → Windows Remote Management (WinRM):
| CIS | Setting | Folder | Set to | Why |
|---|---|---|---|---|
| 18.10.90.1.1 | Allow Basic authentication | WinRM Client | Disabled | Basic auth sends the password nearly in the clear |
| 18.10.90.1.2 | Allow unencrypted traffic | WinRM Client | Disabled | |
| 18.10.90.1.3 | Disallow Digest authentication | WinRM Client | Enabled | Digest is crackable |
| 18.10.90.2.1 | Allow Basic authentication | WinRM Service | Disabled | |
| 18.10.90.2.3 | Allow unencrypted traffic | WinRM Service | Disabled | |
| 18.10.90.2.4 | Disallow WinRM from storing RunAs credentials | WinRM Service | Enabled | RunAs passwords for remote sessions aren't kept on disk |
Level 2: turn it off¶
| CIS | Setting | Set to |
|---|---|---|
| 18.10.90.2.2 | WinRM Service → Allow remote server management through WinRM | Disabled |
| 18.10.91.1 | Windows Remote Shell → Allow Remote Shell Access | Disabled |
| 5.39 | WinRM service | Disabled |
Disable-PSRemoting -Force
Set-Service WinRM -StartupType Disabled -Status Stopped
Verify: netstat -an | findstr "5985 5986" returns nothing.
RPC¶
Remote Procedure Call is the transport under most Windows remote management, including the print spooler and much of what svchost.exe listens on. Two policies make it require authentication.
gpedit.msc → Administrative Templates → System → Remote Procedure Call:
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 18.9.38.1 | Enable RPC Endpoint Mapper Client Authentication | Enabled | Clients authenticate to the endpoint mapper (port 135) |
| 18.9.38.2 | Restrict Unauthenticated RPC clients | Enabled: Authenticated | Anonymous RPC calls are refused |
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Rpc" /v EnableAuthEpResolution /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Rpc" /v RestrictRemoteClients /t REG_DWORD /d 1 /f
Print-specific RPC settings are on the Print Spooler page.
Remote Registry¶
Covered in Services to Disable. Nothing on a workstation needs it.
Firewall exceptions for remote management¶
In Allow an app through firewall, these should be unticked on a workstation: Remote Assistance, Remote Desktop (unless required), Remote Event Log Management, Remote Scheduled Tasks Management, Remote Service Management, Remote Volume Management, Windows Remote Management.
Verify¶
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fAllowToGetHelp
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service" /v AllowBasic
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service" /v AllowUnencryptedTraffic
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Rpc" /v RestrictRemoteClients
0, 0, 0, 1.
Example¶
netstat -abno shows port 5985 listening from svchost.exe under WinRM. The image is a Windows 11 workstation and the README says nothing about remote management. Disable PS remoting and the WinRM service, then confirm the port is closed.