SV-58415r2: A group must be defined on domain systems to include all local administrator accounts. | Windows Vista Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

A group must be defined on domain systems to include all local administrator accounts.

Description

Discussion Text

Several user rights on domain systems require that local administrator accounts be assigned to them. This is separate from the built-in Administrators group, which also contains domain administrative accounts/groups. Defining a consistent group name allows compliance to be more easily determined.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366

References

DPMS Target Windows Vista DISA DPMS Target Windows Vista 1029

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

# Windows PowerShell
# Reconstructed from oval:mil.disa.fso.windows:def:4767
# A group must be defined on domain systems to include all local administrator accounts.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - group_object (group_test) -- Verifies the DenyNetworkAccess group exists: no curated SCC reference for group_object
#   - user_object (user_test) -- Verifies all Local Administrators are included in the DenyNetworkAccess Group: <set> composition (base object oval:mil.disa.fso.windows:obj:11207): member unresolved -- <set> composition (base object oval:mil.disa.fso.windows:obj:11206): member unresolved -- cannot derive an existence probe for this object type
#   - group_object (group_test) -- Verifies the DeniedNetworkAccess group exists: no curated SCC reference for group_object
#   - user_object (user_test) -- Verifies all Local Administrators are included in the DeniedNetworkAccess Group: <set> composition (base object oval:mil.disa.fso.windows:obj:11207): member unresolved -- <set> composition (base object oval:mil.disa.fso.windows:obj:11206): member unresolved -- cannot derive an existence probe for this object type

# System is not a member of a domain
# registry_object (registry_test)
function test_1 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\TCPIP\Parameters').GetValueKind('Domain').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\TCPIP\Parameters' -Name 'Domain' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'Domain') -eq ''))
}

if (test_1) {
  Write-Output "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
} else {
  Write-Output "FAIL (or see MANUAL REVIEW note above)"
}

Assessment Script Powered by AISyntax-verified

A standalone PowerShell script to assess this control automatically. Review before running it in your environment.

Syntax-checked as valid PowerShell. Not executed here — running it for real needs the actual windows_vista target this check assesses.

# OVAL Definition: oval:mil.disa.fso.windows:def:4767
$isDomainJoined = (Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\TCPIP\Parameters" -Name "Domain" -ErrorAction SilentlyContinue).Domain -eq ""
if ($isDomainJoined) {exit 0}
$localGroups = Get-LocalGroup
if (-not ($localGroups -match "DenyNetworkAccess|DeniedNetworkAccess")) {exit 1}
$localAdmins = Get-LocalGroupMember -Group "Administrators"
if ($localAdmins.Count -ne ($localGroups.Count + 1)) {exit 1}
exit 0

Remediation

This requirement is NA for non domain-joined systems.

Create a local group with the name "DenyNetworkAccess" or "DeniedNetworkAccess" on the system.
Include all local administrator accounts as members of the group, including the built-in Administrator account.  Do not include domain administrative accounts or groups.