SV-220908r958482: The built-in administrator account must be disabled. | Microsoft Windows 10 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The built-in administrator account must be disabled.

Description

Discussion Text

The built-in administrator account is a well-known account subject to attack. It also provides no accountability to individual administrators on a system. It must be disabled to prevent its use.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000764SV-78091V-63601

References

DPMS Target Microsoft Windows 10 DISA DPMS Target Microsoft Windows 10 4072

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISyntax-verified

A standalone PowerShell script to assess this control automatically. Review before running it in your environment.

Syntax-checked as valid PowerShell. Not executed here — running it for real needs the actual ms_windows_10 target this check assesses.

# OVAL Definition: oval:mil.disa.stig.windows10:def:220908
$adminAccountDisabled = (Get-CimInstance -ClassName Win32_UserAccount -Filter "LocalAccount=True AND SID LIKE 'S-1-5-21-%-500'").Disabled -eq $true
if ($adminAccountDisabled) { Write-Output "PASS"; Exit 0 } else { Write-Output "FAIL"; Exit 1 }

Remediation

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Administrator account status" to "Disabled".