PAWs used to manage Active Directory must only allow groups specifically designated to manage Active Directory, such as Enterprise and Domain Admins and members of the local Administrators group, to log on locally.

No profile (default benchmark)

I - Mission Critical Classified

I - Mission Critical Public

I - Mission Critical Sensitive

II - Mission Support Classified

II - Mission Support Public

II - Mission Support Sensitive

III - Administrative Classified

III - Administrative Public

III - Administrative Sensitive