The Microsoft SCOM Agent Action Account must be a local system account.
An XCCDF Rule
Description
<VulnDiscussion>The SCOM agent action account is the account agent used to perform tasks on an individual machine. By default, the action agent account is the local system account, but this can be configured to run as a service account. In that scenario, the account will be running locally in memory and could be used by an attacker to laterally move throughout an environment. Using the local system account limits the ability to laterally traverse within the environment if a specific endpoint is compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-237426r643924_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
From the SCOM console, go to the administration workspace. Under Run As Configuration, select Profiles.
Double-click on the Default Action Account in the center pane. From the box that appears, select the Run As accounts link.
Click on each non-management server that is configured with a Run As account and click Edit. From the box that appears, select "Local System Account" in the Run As account drop down. Click OK.