OpenControls Logo

STIG Viewer

STIGViewer Support

A Windows PAW used to manage domain controllers and directory services must not be used to manage any other type of high-value IT resource.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-243454WPAW-00-001300SV-243454r958514_ruleCCI-001082high
Description
Domain controllers (DC) are usually the most sensitive, high-value IT resources in a domain. Dedicating a PAW to be used solely for managing domain controllers will aid in protecting privileged domain accounts from being compromised. For Windows, this includes the management of Active Directory itself and the DCs that run Active Directory, including such activities as domain-level user and computer management, administering trusts, replication, schema changes, site topology, domain-wide group policy, the addition of new DCs, DC software installation, and DC backup and restore operations.
STIGDate
Microsoft Windows PAW Security Technical Implementation Guide2025-05-23

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

SEA-03.2Application Partitioning
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (19) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-3Access Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AU-9Protection of Audit Information
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-5(3)Signed Components
1.00
CM-5(6)Limit Library Privileges
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
IA-5(2)Public Key-based Authentication
1.00
SC-2Separation of System and User Functionality
1.00

+9 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.13.3
1.00
CCI1 mapping
CCI-001082
1.00

Details

Check Text (C-243454r958514_chk)

If domain controllers and directory services are only managed with local logons to domain controllers, not remotely, this requirement is not applicable. Discuss with the Information System Security Manager (ISSM) or PAW system administrators and review any available site documentation. Verify that a site has designated specific PAWs for the sole purpose of remote management of domain controllers and directory service servers. Review any available site documentation. Verify that any PAW used to manage domain controllers and directory services remotely are used exclusively for managing domain controllers and directory services. If the site has not designated specific PAWs for the sole purpose of remote management of domain controllers and directory service servers, this is a finding. If PAWs used for managing domain controllers and directory services are used for additional functions, this is a finding.

Fix Text (F-46686r722932_fix)

Set aside one or more PAWs for remote management of Active Directory. Ensure they are used only for the purpose of managing directory services. Otherwise, use the local domain controller console to manage Active Directory.