Title

Members of the SCOM Administrators Group must be reviewed to ensure access is still required. (Cat II impact)

Discussion

When people leave their roles, their group memberships are often times not updated.

Check Content

From Active Directory Users and Computers, search for the group containing SCOM administrators. Review the users who are listed in this group. If any user in this group is no longer with the organization, no longer requires SCOM administration rights, or is no longer in a SCOM administration role within the organization, this is a finding.

Fix Text

From Active Directory Users and Computers, search for the group containing SCOM administrators. Double-click on the group and select the members tab. For each user that no longer needs rights, select the account and click the Remove button. Click OK once finished.

Additional Identifiers

Rule ID: SV-237423r643915_rule

Vulnerability ID: V-237423

Group Title: SRG-APP-000317-NDM-000282

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.