Title

Separate domain accounts must be used to manage public facing servers from any domain accounts used to manage internal servers. (Cat II impact)

Discussion

Public facing servers should be in DMZs with separate Active Directory forests. If, because of operational necessity, this is not possible, lateral movement from these servers must be mitigated within the forest. Having different domain accounts for administering domain joined public facing servers, from domain accounts used on internal servers, protects against an attacker's lateral movement from a compromised public facing server.

Check Content

If the domain does not have any public facing servers, this is NA. Review the local Administrators group on public facing servers. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group. For public facing servers, the Domain Admins group must be replaced by a domain member server administrator group whose members are different from any used to manage internal servers. If any domain accounts or groups used to manage internal servers are members of the local administrators group, this is a finding.

Fix Text

If the domain does not have any public facing servers, this is NA. Configure the system to include only administrator groups or accounts that are responsible for the system in the local Administrators group. For public facing servers, replace the Domain Admins group with a domain member server administrator group whose members are different from any used to manage internal servers.

Additional Identifiers

Rule ID: SV-243473r959010_rule

Vulnerability ID: V-243473

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.