← Back to Microsoft Windows 11 Security Technical Implementation Guide

V-253289

CAT II (Medium)

The Secondary Logon service must be disabled on Windows 11.

Rule ID

SV-253289r958478_rule

STIG

Microsoft Windows 11 Security Technical Implementation Guide

Version

V2R7

CCIs

CCI-000381

Discussion

The Secondary Logon service provides a means for entering alternate credentials, typically used to run commands with elevated privileges. Using privileged credentials in a standard user session can expose those credentials to theft.

Check Content

Run "Services.msc".

Locate the "Secondary Logon" service.

If the "Startup Type" is not "Disabled" or the "Status" is "Running", this is a finding.

Fix Text

Configure the "Secondary Logon" service "Startup Type" to "Disabled".