STIGQter: STIG Summary: Microsoft Windows 11 Security Technical Implementation Guide Version: 2 Release: 8 Benchmark Date: 01 Jul 2026:

Only accounts responsible for the administration of a system must have Administrator rights on the system.

DISA Rule

SV-253269r958702_rule

Vulnerability Number

V-253269

Group Title

SRG-OS-000312-GPOS-00123

Rule Version

WN11-00-000070

Severity

CAT I

CCI(s)

• CCI-002165 - Enforce organization-defined discretionary access control policies over defined subjects and objects.

Weight

10

Fix Recommendation

Configure the system to include only administrator groups or accounts that are responsible for the system in the local Administrators group.

For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group.

Remove any standard user accounts.

Check Contents

Run "Computer Management".
Navigate to System Tools >> Local Users and Groups >> Groups.
Review the members of the Administrators group.
Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group.

For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group.

Standard user accounts must not be members of the local administrator group.

If prohibited accounts are members of the local administrators group, this is a finding.

The built-in Administrator account or other required administrative accounts would not be a finding.

Vulnerability Number

V-253269

Documentable

False

Rule Version

WN11-00-000070

Severity Override Guidance

Run "Computer Management".
Navigate to System Tools >> Local Users and Groups >> Groups.
Review the members of the Administrators group.
Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group.

For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group.

Standard user accounts must not be members of the local administrator group.

If prohibited accounts are members of the local administrators group, this is a finding.

The built-in Administrator account or other required administrative accounts would not be a finding.

Check Content Reference

M

Target Key

5471