Local users must not exist on a system in a domain.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
WN12-GE-000013	WN12-GE-000013	WN12-GE-000013_rule		Low

Description
To minimize potential points of attack, local users, other than built-in accounts such as Administrator and Guest accounts, must not exist on a workstation in a domain. Users must log onto workstations in a domain with their domain accounts.

STIG	Date
Microsoft Windows Server 2012 Domain Controller Security Technical Implementation Guide	2013-07-25

Details

Check Text ( C-WN12-GE-000013_chk )
This requirement is NA for nondomain-joined systems. Run the DUMPSEC utility. Select "Dump Users as Table" from the "Report" menu. Select the following fields, and click "Add" for each entry: UserName SID AcctDisabled Groups If local users other than the built-in accounts listed below exist on a workstation in a domain, this is a finding: Built-in administrator account (SID ending in 500) Built-in guest account (SID ending in 501) If a site has need of special purpose local user accounts, this must be documented with the IAO.

Check Text ( C-WN12-GE-000013_chk )

This requirement is NA for nondomain-joined systems.

Run the DUMPSEC utility.
Select "Dump Users as Table" from the "Report" menu.
Select the following fields, and click "Add" for each entry:

UserName
SID
AcctDisabled
Groups

If local users other than the built-in accounts listed below exist on a workstation in a domain, this is a finding:

Built-in administrator account (SID ending in 500)
Built-in guest account (SID ending in 501)

If a site has need of special purpose local user accounts, this must be documented with the IAO.

Fix Text (F-WN12-GE-000013_fix)
Configure domain-joined systems to restrict the existence of local user accounts. Remove any unauthorized local accounts.