The system is not configured to make the object creator the owner of objects created by administrators.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3384	2.016	SV-3384r1_rule	ECSC-1	Medium

Description
Either the object creator or the Administrators group owns objects created by members of the Administrators group. In order to ensure accurate auditing and proper accountability, the default owner should be the object creator.

STIG	Date
Windows XP Security Technical Implementation Guide	2013-10-01

Details

Check Text ( C-31r1_chk )
Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “System objects: Default owner for object created by members of the Administrators group” is not set to “Object creator”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \System\CurrentControlSet\Control\Lsa\ Value Name: NoDefaultAdminOwner Value Type: REG_DWORD Value: 1

Check Text ( C-31r1_chk )

Analyze the system using the Security Configuration and Analysis snap-in.
Expand the Security Configuration and Analysis tree view.
Navigate to Local Policies -> Security Options.

If the value for “System objects: Default owner for object created by members of the Administrators group” is not set to “Object creator”, then this is a finding.

The policy referenced configures the following registry value:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \System\CurrentControlSet\Control\Lsa\

Value Name: NoDefaultAdminOwner

Value Type: REG_DWORD
Value: 1

Fix Text (F-60r1_fix)
Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “System objects: Default owner for object created by members of the Administrators group” to “Object creator”.