Nessus Credentialed patch scan – How to setup for Windows

How to setup your Windows environment for a Nessus Credentialed patch scan

If you are reading this you may be undergoing a Cyber Essentials Plus audit, which requires you to undergo a credentialed patch scan, one of the products which can be used is Tenable Nessus.

Your Cyber Essentials certification body may have asked you to configure your environment in preparation for this, this is a requirement and failure to not have a successful credential patch scan will result in your audit failing.

This guide walks you through the process of configuring your environment in preparation for an audit. There are several parts to this configuration and this guide will concentrate using the group policy management tool as a way of configuring the environment. All the configuration settings can be added to the one Group Policy Object.

If you don’t have Active Directory, then you can configure all your machines locally using the Local Group Policy Editor functionality.

This guide also assumes that you are using the built in Windows firewall, if you are using another endpoint firewall such as that from your Antivirus vendor, then add exceptions accordingly.

The steps to configure the environment are as follows:

Create a dedicated Nessus administrator account which has full local access to Windows machines.
Ensuring network profile is configured as ‘Private’
Allow WMI access through the firewall
Allow File and Print Sharing through the firewall
Create a ‘LocalAccountTokenFilterPolicy’ registry entry
Configure Remote Registry service

Creating dedicated Nessus account

Create a domain user and group and name them accordingly, then make the new user is a member of the new group.

Expand your GPO and go to Computer configuration -> Windows Settings -> Security Settings -> Restricted Groups, right click and select ‘Add Group’ and select the group you have just created. This will open up the below screen, add the group, if its not already there then select the button Add button and add ‘builtin\administrators’.

Local administrator group

Click OK to save.

Ensuring network profile is configured as ‘Private’

Expand your GPO and go to Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Network List Manager Policies. Select the network that are using within your business, by default this will be ‘Network’. Click on the ‘Network Location’ tab and then change the location type to ‘Private’.

Once changed, click ok to save.

Network Profile

Allow WMI access through the firewall

Go to Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Windows Firewall with Advanced Security. In the right pane, expand Windows Firewall with Advanced Security until Inbound Rules visible. Right-click on it.

Choose New Rule …
Select Predefined and Windows Management Instrumentation (WMI) in the list
Click Next
Tick all the Windows Management Instrumentation-rules in the list (usually 3 pieces)
Click Next
Select Allow the Connection
Click Finish

WMI through firewall

Allow File and Print Sharing through the firewall

Choose New Rule …
Select Predefined and File and Printer Sharing in the list
Click Next
Tick all the Windows Management Instrumentation-rules in the list (usually 3 pieces)
Click Next
Select Allow The Connection
Click Finish

File and Print Sharing

Create a ‘LocalAccountTokenFilterPolicy’ registry entry

Go to Computer Configuration -> Preferences -> Windows Settings -> Registry, right click on the right pane and select new -> registry item.

For the Key path enter: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
For the value name enter: LocalAccountTokenFilterPolicy.
For the value type, change to: REG_DWORD
For the value data enter: 1

Click OK to save.

Registry Entry

Configure Remote Registry service

Go to Computer Configuration -> Preferences -> Control Panel Settings -> Services, right click on the right pane and select New -> Service.

Change Startup to Automatic.
Select the Service name: Remote Registry
Change Service Action to automatic
Click Ok to save

New Service

And that’s it, once one wait for the changes to propagate around your environment. This will require a computer restart to take effect. You should then be ready for your certification body to perform a scan using Nessus.