Title

If several PAWs are set up in virtual machines (VMs) on a host server, domain administrative accounts used to manage high-value IT resources must not have access to the VM host operating system (OS) (only domain administrative accounts designated to manage PAWs should be able to access the VM host OS). (Cat II impact)

Discussion

The VM host OS should be protected from high-value IT resource administrators accidently or deliberately modifying the security settings of the host OS. Therefore, high-value IT resource administrators must not have the ability to perform maintenance functions on the VM host OS platform.

Check Content

Verify at least one group has been set up in Active Directory (usually Tier 0) for administrators responsible for maintaining VM host OSs (usually the same as the PAW workstation administrator's group). Verify no administrator account or administrator account group has been assigned to both the group of VM host OS administrators and any group for administrators of high-value IT resources. If separate VM host OS administrator groups and administrators of high-value IT resources have not been set up, this is a finding.

Fix Text

Configure the VM host OS so only domain administrative accounts designated to manage PAWs have administrative rights on the VM host OS.

Additional Identifiers

Rule ID: SV-243465r991589_rule

Vulnerability ID: V-243465

Group Title: SRG-OS-000480-GPOS-00227

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.