Windows Security Settings for niLxiDiscovery.exe

[J_Freeman]

I believe this is LabVIEW but please correct me if I am wrong. What are the proper security settings on Windows 10 for these files and folder structures?

c:\Program Files (x86)\IVI Foundation\VISA\WinNT\NIvisa\niLxiDiscovery.exe

c:\program files (x86)\national instruments\shared\tagger\tagsrv.exe

Purpose: Tenable flagged this file as vulnerable.

Plugin 65057 is looking to identify insecure executable permissions as well as folder permissions that are insecure. This information is listed in the Solution of the plugin:

Ensure the groups listed above do not have permissions to modify or write service executables. Additionally, ensure these groups do not have Full Control permission to any directories that contain service executables.

This means that any time Nessus observes an executable in a folder with Full Control permissions  the plugin will flag this information in its output.

Path : c:\program files (x86)\ivi foundation\visa\winnt\nivisa\nilxidiscovery.exe
Used by services : niLXIDiscovery
File write allowed for groups : Everyone (S-1-1-0)
Full control of directory allowed for groups : Everyone (S-1-1-0)

Path : c:\program files (x86)\national instruments\shared\tagger\tagsrv.exe
Used by services : NITaggerService
File write allowed for groups : Authenticated Users (S-1-5-11)
Full control of directory allowed for groups : Authenticated Users (S-1-5-11)

[Kyle97330]

I mean, I'm pretty sure that ANY .exe file in a "Program Files" should be set to have System and Administrator with full access, and everyone else to only have Read and Execute permissions.

I would suggest you set both of these to have that level of permissions.

If you then start getting errors or something doesn't work related to these EXEs, you can then revisit and see if you need exceptions.

"niLxiDiscovery.exe" finds unknown Ethernet devices that use the LXI protocol on local networks.  "tagsrv.exe" is the shared variable service.  There's a good chance you don't use either of those, so even if they fail due to permissions you might not care.

[J_Freeman]

Thanks for the reply. I wanted to confirm before making the change and chasing errors if it came to that.