Membership to the Schema Admins group must be limited.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-243502 | AD.0017 | SV-243502r1026198_rule | CCI-000366 | medium |
| Description | ||||
| The Schema Admins group is a privileged group in a forest root domain. Members of the Schema Admins group can make changes to the schema, which is the framework for the Active Directory forest. Changes to the schema are not frequently required. This group only contains the Built-in Administrator account by default. Additional accounts must only be added when changes to the schema are necessary and then must be removed. | ||||
| STIG | Date | |||
| Active Directory Forest Security Technical Implementation Guide | 2025-05-15 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-6
1.00
- DISA · V3R2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.4.1
1.00
- DISA · V3R2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.4.2
1.00
- DISA · V3R2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000366
1.00
- DISA · V3R2 · disa_xccdf · related
Details
Check Text (C-243502r1026198_chk)
Open "Active Directory Users and Computers" on a domain controller in the forest root domain.
Navigate to the "Users" container.
Right-click on "Schema Admins" and select "Properties", and then select the "Members" tab.
If any accounts other than the built-in Administrators group are members, verify their necessity with the ISSO.
If any accounts are members of the group when schema changes are not being made, this is a finding.
Fix Text (F-46734r1026197_fix)
Limit membership in the Schema Admins group to only those accounts necessary during a schema update. Remove accounts when the updates are complete. Document accounts necessary during schema updates with the ISSO.