WPAW-00-002300 - The local Administrators group on the Windows PAW must only include groups with accounts specifically designated to administer the PAW.

Information

A main security architectural construct of a PAW is to restrict access to the PAW from only specific privileged accounts designated for managing the high-value IT resources the PAW has been designated to manage. If unauthorized standard user accounts or unauthorized high-value administrative accounts are able to access a specific PAW, high-value IT resources and critical DoD information could be compromised.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Restrict membership of the local Administrators group to only include members of the group specifically designated to manage the PAW and local administrator(s).

See the Microsoft PAW paper (https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/privileged-access-workstations) for more information (go to PAW Installation instructions).

Item Details

Audit Name: DISA Microsoft Windows PAW STIG v3r2

Category: CONFIGURATION MANAGEMENT

Plugin: Windows

Control ID: 47425b9f95bfd0420e1b1904705964c1147948d3f058ab2b974e635c6eb1f209

Detections

Analytics

WPAW-00-002300 - The local Administrators group on the Windows PAW must only include groups with accounts specifically designated to administer the PAW.

Information

Solution

See Also

Item Details