Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-1168 | WN08-00-000006 | SV-48059r1_rule | ECLP-1 | Medium |
Description |
---|
Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Members of the Backup Operators group must have separate logon accounts for performing backup duties. |
STIG | Date |
---|---|
Windows 8 Security Technical Implementation Guide | 2014-01-07 |
Check Text ( C-44798r1_chk ) |
---|
Review the Backup Operators group in Computer Management. If the group contains any accounts, this must be documented with the IAO. Any accounts that are members of the Backup Operators group must be documented, including application accounts. Users with accounts in the Backup Operators group will have a separate user account for backup functions and for performing normal user tasks. If the group contains no accounts, this is not a finding. If any of the following conditions are true, this is a finding: -Each Backup Operator does not have a unique userid dedicated to the backup function. -Each Backup Operator does not have a separate account for normal user tasks. -The IAO does not maintain a list of users belonging to the Backup Operators group. |
Fix Text (F-41197r1_fix) |
---|
Ensure that each member has separate accounts for user tasks and for backup operator functions. Create the necessary documentation that identifies the members of the Backup Operators group. |