Members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
WN08-00-000006	WN08-00-000006	WN08-00-000006_rule		Medium

Description
Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Members of the Backup Operators group must have separate logon accounts for performing backup duties.

STIG	Date
Windows 8 Security Technical Implementation Guide	2012-11-21

Details

Check Text ( C-WN08-00-000006_chk )
Review the Backup Operators group in Computer Management. If the group contains any accounts, this must be documented with the IAO. Any accounts that are members of the Backup Operators group must be documented, including application accounts. Each Backup Operator will have a separate user account for backup functions and for performing normal user tasks. If the group contains no accounts, this is not a finding. If any of the following conditions are true, this is a finding: -Each Backup Operator does not have a unique userid dedicated to the backup function. -Each Backup Operator does not have a separate account for normal user tasks. -The IAO does not maintain a list of users belonging to the Backup Operators group.

Check Text ( C-WN08-00-000006_chk )

Review the Backup Operators group in Computer Management.

If the group contains any accounts, this must be documented with the IAO.

Any accounts that are members of the Backup Operators group must be documented, including application accounts. Each Backup Operator will have a separate user account for backup functions and for performing normal user tasks.

If the group contains no accounts, this is not a finding.
If any of the following conditions are true, this is a finding:

-Each Backup Operator does not have a unique userid dedicated to the backup function.
-Each Backup Operator does not have a separate account for normal user tasks.
-The IAO does not maintain a list of users belonging to the Backup Operators group.

Fix Text (F-WN08-00-000006_fix)
Create the necessary documentation that identifies the members of the Backup Operators group. Ensure that each member has separate accounts for user tasks and for backup operator functions.