Remote Desktop Users Group is showing up incorrectly in a query in CCS.
Article ID: 278667
Updated On:
Products
Issue/Introduction
When running a CCS Query for "Security : File System (Effective)", the "Remote Desktop Users" group is showing up.
This group does not show as having any permissions on these folders, and should not be showing up.
Cause
When creating the query after selecting the assets, the "Override default options" have been enabled and the "Analysis Types" has been changed to "Local and network analysis".
Resolution
The Local and network analysis option instructs the query to do a full analysis of effective permissions whether they are obtained by logging on locally or by accessing the file system object through a share. This option executes a local analysis and a network analysis and combines the results.
As a part of calculating effective permissions, the CCS data collector will check if the Group/User ( Local or domain) has "SeRemoteInteractiveLogonRight" permissions set.
This is determined using either Group policy or Local security policy. On the target machine, check values sets for the local policy "Allow log on through Remote Desktop Services".
On the target machine, launch "Administrative Tools->Local Security Policy" and check the above policy settings at -> Security Settings\Local Policies\User Rights Assignment.
This security setting determines which users or groups have permission to log on as a Remote Desktop Services client.
Default:
On workstations and servers: Administrators, Remote Desktop Users.
On domain controllers: Administrators.
This remote desktop user can also access the directory/files once logged in. Because of this policy, the "Remote Desktop Users" is in the query result for effective permissions.
Feedback
