Title

Specified groups are not restricted. (Cat II impact)

Discussion

The Restricted Groups option allows the administrator to manage membership of sensitive groups. The Power Users group is one such group. This group has been given significant privileges under Windows 2000.

Check Content

Expand the “Security Configuration and Analysis” object in the tree window. Expand the “Restricted Groups” object. Double click the value for “Power Users”. If there are any users or groups listed under the “members” tab, then this is a finding. If there are any groups listed under the “member of” tab, then this is a finding.

Fix Text

Configure the system to restrict membership of the Power Users group to have no accounts or groups as members.

Additional Identifiers

Rule ID: SV-29764r1_rule

Vulnerability ID: V-2375

Group Title: Power User Restrictions

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.