SV-226273r794581: The built-in administrator account must be renamed. | Microsoft Windows Server 2012/2012 R2 Domain Controller STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The built-in administrator account must be renamed.

Description

Discussion Text

The built-in administrator account is a well-known account subject to attack. Renaming this account to an unidentified name improves the protection of this account and the system.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366CCE-23836-0SV-52857V-1115

References

DPMS Target Microsoft Windows Server 2012-2012 R2 DC DISA DPMS Target Microsoft Windows Server 2012-2012 R2 DC 4217

Checks

DISA STIG (Manual Reference)

Verify the effective setting in Local Group Policy Editor.
Run "gpedit.msc".

Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options.

If the value for "Accounts: Rename administrator account" is not set to a value other than "Administrator", this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

# Windows PowerShell
# Reconstructed from oval:mil.disa.fso.windows:def:4541
# The built-in administrator account must be renamed.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - user_object (user_test) -- Verifies 'Accounts: Rename administrator account' is set to a value other than 'Administrator': no extractor for field "user"

Write-Output "MANUAL REVIEW REQUIRED -- see notes above; no part of this check could be automated"

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# Shell script implementing DISA STIG / SCAP compliance check oval:mil.disa.fso.windows:def:4541

if [ ! -e "$PSFILE" ]; then echo "PASS"; exit 0; fi
if [ "$(grep -E '^S-100H-AD-5-ACCOUNT_RENAME_ADMINISTRATOR_NAME' "$PSFILE" | wc -l)" -eq 0 ] || [ "$(grep -E '^\\s*value\\s*=\\s*[^,]*' "$PSFILE" | grep -v '^\\s*value\\s*=\\s*Administrator' | wc -l)" -eq 0 ]; then echo "FAIL"; exit 1; fi
echo "PASS"; exit 0

Remediation

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Accounts: Rename administrator account" to a name other than "Administrator".