Detections
Analytics

1.180 WN19-DC-000350

Information

Windows Server 2019 Add workstations to domain user right must only be assigned to the Administrators group on domain controllers.

GROUP ID: V-205744
RULE ID: SV-205744r958726

Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.

Accounts with the 'Add workstations to domain' right may add computers to a domain. This could result in unapproved or incorrectly configured systems being added to a domain.

Solution

Configure the policy value for

Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> 'Add workstations to domain'

to include only the following accounts or groups:

 - Administrators

See Also

https://workbench.cisecurity.org/benchmarks/22176

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(7)(b)

Plugin: Windows

Control ID: 9aea24a3c01bdf0fe56b42e324cf354a84367d0777251322bb2e5579e46588cf