SV-225450r569185: The built-in administrator account must be renamed. | Microsoft Windows Server 2012/2012 R2 Member Server STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The built-in administrator account must be renamed.

Description

Discussion Text

The built-in administrator account is a well-known account subject to attack. Renaming this account to an unidentified name improves the protection of this account and the system.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366CCE-23836-0SV-52857V-1115

References

DPMS Target Microsoft Windows Server 2012-2012 R2 MS DISA DPMS Target Microsoft Windows Server 2012-2012 R2 MS 4214

Checks

DISA STIG (Manual Reference)

Verify the effective setting in Local Group Policy Editor.
Run "gpedit.msc".

Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options.

If the value for "Accounts: Rename administrator account" is not set to a value other than "Administrator", this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

# Windows PowerShell
# Reconstructed from oval:mil.disa.fso.windows:def:4541
# The built-in administrator account must be renamed.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - user_object (user_test) -- Verifies 'Accounts: Rename administrator account' is set to a value other than 'Administrator': no extractor for field "user"

Write-Output "MANUAL REVIEW REQUIRED -- see notes above; no part of this check could be automated"

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.fso.windows:def:4541

if [ ! -d "/Users/Administrator" ]; then echo "PASS"; exit 0; fi
if [ "$(ls /Users/Administrator 2>/dev/null | grep -o 'Administrator$')" ]; then echo "FAIL"; exit 1; fi
echo "PASS"; exit 0

Remediation

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Accounts: Rename administrator account" to a name other than "Administrator".