CIS Microsoft Windows 10 Enterprise Release 1909 Benchmark

5.11 (L1) Ensure 'Microsoft FTP Service (FTPSVC)' is set to 'Disabled' or 'Not Installed' (Scored)

ProfileApplicability:

 Level 1 (L1) - Corporate/Enterprise Environment (general use)

Description:

Enables the server to be a File Transfer Protocol (FTP) server.

The recommended state for this setting is: Disabled or Not Installed .

Note: This service is not installed by default. It is supplied withWindows, but is installed by enabling an optional Windows feature ( Internet Information Services - FTP Server ).

Rationale:

Hosting an FTP server (especially a non-secure FTP server) from a workstation is an increased security risk, as the attack surface of that workstation is then greatly increased.

Note: This security concern applies to any FTP server application installed on a workstation, not just IIS.

Audit:

Navigate to the UI Path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FTPSVC:Start

Remediation:

To establish the recommended configuration via GP, set the following UI path to: Disabled or ensure the service is not installed.

Computer Configuration\Policies\Windows Settings\Security Settings\System Services\Microsoft FTP Service

Impact:

The computer will not function as an FTP server.

316 | P a g e