STIGQter STIGQter: STIG Summary: Windows PAW Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 15 May 2020:

The local Administrators group on the Windows PAW must only include groups with accounts specifically designated to administer the PAW.

DISA Rule

SV-92891r1_rule

Vulnerability Number

V-78185

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

WPAW-00-002300

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Restrict membership of the local Administrators group to only include members of the group specifically designated to manage the PAW and local administrator(s).

See the Microsoft PAW paper (https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/privileged-access-workstations) for more information (go to PAW Installation instructions).

Check Contents

Verify the PAW is configured to restrict access to privileged accounts specifically designated to administer the PAW:

- On the Windows PAW, verify the membership of the local Administrators group.
- Verify the only members in the local Administrators group are the group specifically designated for managing the PAW and local administrator(s).

If the local Administrators group includes any members not members of the specifically designated group for managing the PAW and local administrator(s), this is a finding.

Vulnerability Number

V-78185

Documentable

False

Rule Version

WPAW-00-002300

Severity Override Guidance

Verify the PAW is configured to restrict access to privileged accounts specifically designated to administer the PAW:

- On the Windows PAW, verify the membership of the local Administrators group.
- Verify the only members in the local Administrators group are the group specifically designated for managing the PAW and local administrator(s).

If the local Administrators group includes any members not members of the specifically designated group for managing the PAW and local administrator(s), this is a finding.

Check Content Reference

M

Target Key

3283

Comments