User accounts with delegated authority must be removed from Windows built-in administrative groups or remove the delegated authority from the accounts.
An XCCDF Rule
Description
<VulnDiscussion>In AD it is possible to delegate account and other AD object ownership and administration tasks. (This is commonly done for help desk or other user support staff.) This is done to avoid the need to assign users to Windows groups with more widely ranging privileges. If a user with delegated authority to user accounts in a specific OU is also a member of the Administrators group, that user has the ability to reconfigure a wide range of domain security settings and change user accounts outside of the OU to which s/he is a delegated authority. A lack of specific baseline documentation of accounts with delegated privileges makes it impossible to determine if the configured privileges are consistent with the intended security policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-243488r959010_rule
- Severity
- Low
- References
- Updated
Remediation - Manual Procedure
1. Remove user accounts with delegated authority from Windows built-in administrative groups or remove the delegated authority from the accounts.
2. Document all user accounts with delegated AD object ownership or update authority.
3. Annotate the account list with a statement such as, "The high number of privileged accounts is required to address site operational requirements."