If several PAWs are set up in virtual machines (VMs) on a host server, domain administrative accounts used to manage high-value IT resources must not have access to the VM host operating system (OS) (only domain administrative accounts designated to manage PAWs should be able to access the VM host OS).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-243465	WPAW-00-002600	SV-243465r722970_rule		Medium

Description
The VM host OS should be protected from high-value IT resource administrators accidently or deliberately modifying the security settings of the host OS. Therefore, high-value IT resource administrators must not have the ability to perform maintenance functions on the VM host OS platform.

STIG	Date
Microsoft Windows PAW Security Technical Implementation Guide	2022-03-01

Details

Check Text ( C-46740r722964_chk )
Verify at least one group has been set up in Active Directory (usually Tier 0) for administrators responsible for maintaining VM host OSs (usually the same as the PAW workstation administrator's group). Verify no administrator account or administrator account group has been assigned to both the group of VM host OS administrators and any group for administrators of high-value IT resources. If separate VM host OS administrator groups and administrators of high-value IT resources have not been set up, this is a finding.

Check Text ( C-46740r722964_chk )

Verify at least one group has been set up in Active Directory (usually Tier 0) for administrators responsible for maintaining VM host OSs (usually the same as the PAW workstation administrator's group).

Verify no administrator account or administrator account group has been assigned to both the group of VM host OS administrators and any group for administrators of high-value IT resources.

If separate VM host OS administrator groups and administrators of high-value IT resources have not been set up, this is a finding.

Fix Text (F-46697r722965_fix)
Configure the VM host OS so only domain administrative accounts designated to manage PAWs have administrative rights on the VM host OS.