The local Administrators group on the Windows PAW must only include groups with accounts specifically designated to administer the PAW.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-243462 | WPAW-00-002300 | SV-243462r991589_rule | CCI-000366 | medium |
| Description | ||||
| A main security architectural construct of a PAW is to restrict access to the PAW from only specific privileged accounts designated for managing the high-value IT resources the PAW has been designated to manage. If unauthorized standard user accounts or unauthorized high-value administrative accounts are able to access a specific PAW, high-value IT resources and critical DoD information could be compromised. | ||||
| STIG | Date | |||
| Microsoft Windows PAW Security Technical Implementation Guide | 2025-05-23 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-6
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.4.1
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.4.2
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000366
1.00
- DISA · 3 · disa_xccdf · related
Details
Check Text (C-243462r991589_chk)
Verify the PAW is configured to restrict access to privileged accounts specifically designated to administer the PAW:
- On the Windows PAW, verify the membership of the local Administrators group.
- Verify the only members in the local Administrators group are the group specifically designated for managing the PAW and local administrator(s).
If the local Administrators group includes any members not members of the specifically designated group for managing the PAW and local administrator(s), this is a finding.
Fix Text (F-46694r722956_fix)
Restrict membership of the local Administrators group to only include members of the group specifically designated to manage the PAW and local administrator(s).
See the Microsoft PAW paper (https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/privileged-access-workstations) for more information (go to PAW Installation instructions).