Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-1148 | 4.024 | SV-25214r2_rule | Low |
Description |
---|
To minimize potential points of attack, local users, other than built-in accounts such as Administrator and Guest accounts, should not exist on a workstation in a domain. Users must always log onto workstations in a domain with their domain accounts. |
STIG | Date |
---|---|
Windows 7 Security Technical Implementation Guide | 2018-02-12 |
Check Text ( C-60957r2_chk ) |
---|
Run the DUMPSEC utility. Select "Dump Users as Table" from the "Report" menu. Select the following fields, and click "Add" for each entry: UserName SID AcctDisabled Groups If local users other than the built-in accounts listed below exist on a workstation in a domain, this is a finding: Built-in administrator account (SID ending in 500) Built-in guest account (SID ending in 501) If the organization has a need for special purpose local user accounts such as a backup administrator account (see V-14224), this must be documented with the ISSO. This would not be a finding. |
Fix Text (F-65689r1_fix) |
---|
Limit local user accounts on domain-joined systems. Remove any unauthorized local accounts. |