UCF STIG Viewer Logo

The SharePoint setup user domain account must be configured with the minimum privileges in Active Directory.


Overview

Finding ID Version Rule ID IA Controls Severity
V-29399 SHPT-00-000193 SV-38299r2_rule Medium
Description
Separation of duties is a prevalent Information Technology control implemented at different layers of the information system including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires the person accountable for approving an action not be the same person tasked with implementing the action. This requirement is intended to limit exposure due to users (or entities acting on behalf of users) being used to operate from within a privileged account or role. Limiting the access and permissions of privileged accounts to the minimum required, reduces exposure if the account is compromised and provides forensic history of activity when operating from these accounts. See TechNet Article cc678863 for information regarding required permission. The setup user administrator account is used during initial creation of the farm, to update the farm servers, and to configure certain farm configuration option. The setup user administrator account should be limited to membership in the Domain Users group in Active Directory.
STIG Date
MS SharePoint 2010 Security Technical Implementation Guide 2019-01-02

Details

Check Text ( C-37712r3_chk )
1. Navigate to Active Directory Users and Computers -> Users.
2. Double click on the account to view the account properties.
3. Select the Members of tab and verify this account is a member of the Domain Users group only.
4. Mark as a finding if the Setup User account is a member of other Active Directory domain groups other than Domain Users. Mark as a finding if the Setup User account has unneeded permissions or services assigned.
Fix Text (F-32959r3_fix)
Ensure the Setup User domain user has minimum permissions in Active Directory.
1. Navigate to Active Directory Users and Computers -> Users.
2. Double click on the account to view the account properties.
3. Select the Members of tab to view group membership for this account.
4. Remove this account from membership in groups other than Domain Users.