Skip to content
Catalogs
XCCDF
Active Directory Domain Security Technical Implementation Guide
SRG-OS-000480
User accounts with delegated authority must be removed from Windows built-in administrative groups or remove the delegated authority from the accounts.
User accounts with delegated authority must be removed from Windows built-in administrative groups or remove the delegated authority from the accounts. An XCCDF Rule
User accounts with delegated authority must be removed from Windows built-in administrative groups or remove the delegated authority from the accounts.
Low Severity
<VulnDiscussion>In AD it is possible to delegate account and other AD object ownership and administration tasks. (This is commonly done for help desk or other user support staff.) This is done to avoid the need to assign users to Windows groups with more widely ranging privileges. If a user with delegated authority to user accounts in a specific OU is also a member of the Administrators group, that user has the ability to reconfigure a wide range of domain security settings and change user accounts outside of the OU to which s/he is a delegated authority. A lack of specific baseline documentation of accounts with delegated privileges makes it impossible to determine if the configured privileges are consistent with the intended security policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>