Microsoft Windows: Allow users to connect remotely by using Remote Desktop Services

# Copyright (C) 2018 Greenbone Networks GmbH
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-or-later
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.109464");
  script_version("2022-08-31T10:10:28+0000");
  script_tag(name:"last_modification", value:"2022-08-31 10:10:28 +0000 (Wed, 31 Aug 2022)");
  script_tag(name:"creation_date", value:"2018-06-27 11:14:55 +0200 (Wed, 27 Jun 2018)");
  script_tag(name:"cvss_base", value:"0.0");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:H/Au:S/C:N/I:N/A:N");
  script_tag(name:"qod", value:"97");

  script_name("Microsoft Windows: Allow users to connect remotely by using Remote Desktop Services");

  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2018 Greenbone Networks GmbH");
  script_family("Policy");
  script_dependencies("compliance_tests.nasl", "smb_reg_service_pack.nasl");
  script_mandatory_keys("Compliance/Launch");

  script_add_preference(name:"Value", type:"radio", value:"1;0", id:1);

  script_xref(name:"URL", value:"https://www.microsoft.com/en-us/download/confirmation.aspx?id=25250");

  script_tag(name:"summary", value:"This policy setting allows you to configure remote access to
computers by using Remote Desktop Services.

If you enable this policy setting, users who are members of the Remote Desktop Users group on the
target computer can connect remotely to the target computer by using Remote Desktop Services.

If you disable this policy setting, users cannot connect remotely to the target computer by using
Remote Desktop Services. The target computer will maintain any current connections, but will not
accept any new incoming connections.

If you do not configure this policy setting, Remote Desktop Services uses the Remote Desktop setting
on the target computer to determine whether the remote connection is allowed. This setting is found
on the Remote tab in the System properties sheet. By default, remote connections are not allowed.

Note: You can limit which clients are able to connect remotely by using Remote Desktop Services by
configuring the policy setting at Computer Configuration\Administrative Templates\Windows
Components\Remote Desktop Services\Remote Desktop Session Host\Security\Require user authentication
for remote connections by using Network Level Authentication.

You can limit the number of users who can connect simultaneously by configuring the policy setting
at Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote
Desktop Session Host\Connections\Limit number of connections, or by configuring the policy setting
Maximum Connections by using the Remote Desktop Session Host WMI Provider.

(C) Microsoft Corporation 2015.");

  exit(0);
}

include("smb_nt.inc");
include("policy_functions.inc");
include("version_func.inc");

target_os = "Microsoft Windows 7 or later";
win_min_ver = "6.1";
title = "Allow users to connect remotely by using Remote Desktop Services";
solution = "Set following UI path accordingly:
Computer Configuration/Administrative Templates/Windows Components/
Remote Desktop Services/Remote Desktop Session Host/Connections/" + title;
test_type = "RegKey";
type = "HKLM";
key = "Software\Policies\Microsoft\Windows NT\Terminal Services";
item = "fDenyTSConnections";
reg_path = type + "\" + key + "!" + item;
default = script_get_preference("Value");

if(!policy_verify_win_ver(min_ver:win_min_ver))
  results = policy_report_wrong_os(target_os:target_os);
else
  results = policy_match_exact_reg_dword(key:key, item:item, type:type, default:default);

value = results["value"];
comment = results["comment"];
compliant = results["compliant"];

policy_reporting(result:value, default:default, compliant:compliant, fixtext:solution,
  type:test_type, test:reg_path, info:comment);
policy_set_kbs(type:test_type, cmd:reg_path, default:default, solution:solution, title:title,
  value:value, compliant:compliant);

exit(0);