How we broke Remote Disk Management by changing the “Access this computer from the network” setting
As part of our security strategy, we’ve been using the CIS Benchmark as our system hardening guide. One of the settings we implemented broke the Windows Disk Management utility when used remotely in an unexpected way. I couldn’t find anything on the Internet discussing this solution, so I thought I would post about it.
One of the changes recommended by the CIS Benchmark for Windows and Active Directory is to modify some of the default User Rights Assignments:
Windows Settings\Security Settings\Local Policies\User Rights Assignment\Access this computer from the network Default setting: Administrators, Backup Operators, Users, Everyone CIS Benchmark: Administrators, Remote Desktop Users
This setting is pretty reasonable for non-servers (only!), since it prevents user-created shares from working and could potentially prevent some lateral movement by malware or APTs.
After applying the setting via Group Policy, we noticed that we could no longer use Disk Management to access a remote computer. Attempting to click on the Storage\Disk Management node in MMC for a remote computer would cause an error message: “You do not have access rights to Logical Disk Manager on <Computername>.” The status bar included a message that said, “Unable to connect to Virtual Disk Service.”
We were using an administrator account and Disk Management would work perfectly fine if we directly logged into that computer with that account. However, when trying to access it remotely using Computer Management, it would error out. Remote Computer Management worked fine otherwise: we could modify groups, read the event log, etc.
We assumed that our recent change to group policy had broken the program, but it didn’t make any sense. We were using an Administrator account and the “Access this computer from the network” setting included the Administrators group.
After some troubleshooting, we eventually determined that when we launch Disk Management and connect to the Virtual Disk Service on a remote machine, THAT MACHINE connects back to our management computer. Because the rights assignment change removed EVERYONE, it was now preventing connections from the remote computer account.
For example, say we have 2 computers (\\MGMT and \\USER). We’re running computer management on \\MGMT, trying to connect to Disk Management on \\USER. The solution to the problem is to add the computer account (USER$) to the “Access this computer from the network” setting on \\MGMT. As soon as you add the remote computer account, Disk Management begins working properly.
For a final fix, this meant that we had to apply a special exception to the CIS Benchmark setting for IT staff computers (only). On their computers, we adjusted the setting to include the Domain Computers group. Windows Settings\Security Settings\Local Policies\User Rights Assignment Access this computer from the network Default setting: Administrators, Backup Operators, Users, Everyone CIS Benchmark: Administrators, Remote Desktop Users Fixed Setting: Administrators, Remote Desktop Users, Domain Computers
Again, the change only has to be made on the computer where you will be running Disk Management (MMC) to connect to remote computers. No changes need to be made to policies on the remote computer.
In researching the problem, I encountered a lot of people having problems similar to this one. I would assume that this problem could also occur in a non-domain environment when you have computers that don’t trust each other. For example, you’re connecting to the remote computer as a Local Administrator, but it can’t connect back to your computer due to insufficient rights. Similarly, I would expect that firewall settings could prevent the reverse connection and cause this error.