The Microsoft SCOM server must use an active directory group that contains authorized members of the SCOM Administrators Role Group.
An XCCDF Rule
Description
During the initial installation, SCOM grants the Builtin\Administrators group administrator rights to the application. This configuration will allow any local administrator to the SCOM server to have full administrative rights into SCOM.
- ID
- SV-237436r643954_rule
- Version
- SCOM-IA-000002
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
From Active Directory Users and Computers, create a group following the organizational naming standards for SCOM Administrators. Add the SCOM service accounts to this group along with any user's administrative account that is required to administer SCOM. Make note of the group name.
Log on to the SCOM console with an administrative account. Select the Administration workspace. Expand Security and click User Roles. From the center pane, double-click on Operations Manager Administrators.
Click the Add button and type the name of the group created above and click Check Names. The name should validate. Click OK.
The new group should now be added to the Operations Manager Administrators role. Click on Builtin\Administrators and click Remove. Click OK.