STIGQter: STIG Summary: Active Directory Domain Security Technical Implementation Guide (STIG) Version: 2 Release: 13 Benchmark Date: 26 Apr 2019:

User accounts with delegated authority must be removed from Windows built-in administrative groups or remove the delegated authority from the accounts.

DISA Rule

SV-9018r3_rule

Vulnerability Number

V-8521

Group Title

Object Ownership Delegation

Rule Version

AD.0260

Severity

CAT III

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

1. Remove user accounts with delegated authority from Windows built-in administrative groups or remove the delegated authority from the accounts.

2. Document all user accounts with delegated AD object ownership or update authority.

3. Annotate the account list with a statement such as, “The high number of privileged accounts is required to address site operational requirements.”

4. Reduce the number of user accounts with delegated AD object ownership or update authority.

Check Contents

1. Interview the IAM or site representative and obtain the list of accounts that have been delegated AD object ownership or update permissions and that are not members of Windows built-in administrative groups.
(This includes accounts for help desk or support personnel who are not Administrators, but have authority in AD to maintain user accounts or printers.)

2. If accounts with delegated authority are defined and there is no list, then this is a finding.

3. Count the number of accounts on the list.

4. If the number of accounts with delegated authority is greater than 10, review the site documentation that justifies this number. Validate that the IAM explicitly acknowledges the need to have a high number of privileged users.

5. If the number of accounts with delegated authority is greater than 10 and there is no statement in the documentation that justifies the number, then this is a finding.

Vulnerability Number

V-8521

Documentable

False

Rule Version

AD.0260

Severity Override Guidance

1. Interview the IAM or site representative and obtain the list of accounts that have been delegated AD object ownership or update permissions and that are not members of Windows built-in administrative groups.
(This includes accounts for help desk or support personnel who are not Administrators, but have authority in AD to maintain user accounts or printers.)

2. If accounts with delegated authority are defined and there is no list, then this is a finding.

3. Count the number of accounts on the list.

4. If the number of accounts with delegated authority is greater than 10, review the site documentation that justifies this number. Validate that the IAM explicitly acknowledges the need to have a high number of privileged users.

5. If the number of accounts with delegated authority is greater than 10 and there is no statement in the documentation that justifies the number, then this is a finding.

Check Content Reference

M

Responsibility

Information Assurance Manager

Target Key

870

Comments