Active Directory Domain Security Technical Implementation Guide

The Active Directory Domain Security Technical Implementation Guide (V3 R8) has 36 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

36STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R8

CurrentPublished Wed Sep 30 2026

Delegation of privileged accounts must be prohibited.

Active Directory Domain Security Technical Implementation Guide

Assessment Title

Rule Text

Delegation of privileged accounts must be prohibited.

Description

Discussion Text

Privileged accounts such as those belonging to any of the administrator groups must not be trusted for delegation. Allowing privileged accounts to be trusted for delegation provides a means for privilege escalation from a compromised system.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-243470

Rule

SV-243470r959010_rule

Severity

high

Rule Version

AD.0005

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Review the properties of all privileged accounts in Active Directory Users and Computers. Under the Account tab, verify "Account is sensitive and cannot be delegated" is selected in the Account Options section. If delegation is not prohibited for any  privileged account, this is a finding.

Implementation Procedure

Fix Text

Open Active Directory Users and Computers. View the properties of all privileged accounts. Under the Account tab, select "Account is sensitive and cannot be delegated" in the Account Options section.

STIG check 5 of 36 in the Active Directory Domain STIG checklist

← Previous · V-243469Administrators must have separate accounts specifically for managing domain workstations.Next · V-243471 →Local administrator accounts on domain systems must not share the same password.