Windows 10 Security Technical Implementation Guide

The Windows 10 Security Technical Implementation Guide (V2 R3) has 257 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

257STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R3

CurrentPublished Mon Nov 01 2021

Standard local user accounts must not exist on a system in a domain.

Windows 10 Security Technical Implementation Guide

Assessment Title

Rule Text

Standard local user accounts must not exist on a system in a domain.

Description

Discussion Text

To minimize potential points of attack, local user accounts, other than built-in accounts and local administrator accounts, must not exist on a workstation in a domain. Users must log onto workstations in a domain with their domain accounts.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-220715

Rule

SV-220715r569187_rule

Severity

low

Rule Version

WN10-00-000085

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Run "Computer Management".
Navigate to System Tools >> Local Users and Groups >> Users.

If local users other than the accounts listed below exist on a workstation in a domain, this is a finding.

Built-in Administrator account (Disabled)
Built-in Guest account (Disabled)
Built-in DefaultAccount (Disabled)
Built-in defaultuser0 (Disabled)
Built-in WDAGUtilityAccount (Disabled)
Local administrator account(s)

All of the built-in accounts may not exist on a system, depending on the Windows 10 version.

Implementation Procedure

Fix Text

Limit local user accounts on domain-joined systems.  Remove any unauthorized local accounts.

STIG check 19 of 257 in the Windows 10 STIG checklist

← Previous · V-220714Only authorized user accounts must be allowed to create or run virtual machines on Windows 10 systems.Next · V-220716 →Accounts must be configured to require password expiration.