CIS Microsoft Windows 10 Enterprise RTM (Release 1507) Benchmark

2.2.12 (L1) Set 'Create global objects' to 'Administrators, LOCAL SERVICE,
NETWORK SERVICE, SERVICE' (Scored)
Profile Applicability:
Level 1
Level 1 + BitLocker
Description:
This policy setting determines whether users can create global objects that are available to
all sessions. Users can still create objects that are specific to their own session if they do not
have this user right.
Users who can create global objects could affect processes that run under other users'
sessions. This capability could lead to a variety of problems, such as application failure or
data corruption.
The recommended state for this setting is: Administrators, LOCAL SERVICE, NETWORK
SERVICE, SERVICE.
Rationale:
Users who can create global objects could affect Windows services and processes that run
under other user or system accounts. This capability could lead to a variety of problems,
such as application failure, data corruption and elevation of privilege.
Audit:
Navigate to the UI Path articulated in the Remediation section and confirm it is set as
prescribed.
Remediation:
To establish the recommended configuration via GP, set the following UI path to
Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE:
Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User
Rights Assignment\Create global objects
Impact:
None. This is the default configuration.
73 | P a g e