← Back to Active Directory Domain Security Technical Implementation Guide

V-243466

CAT I (High)

Membership to the Enterprise Admins group must be restricted to accounts used only to manage the Active Directory Forest.

Rule ID

SV-243466r1266527_rule

STIG

Active Directory Domain Security Technical Implementation Guide

Version

V3R8

CCIs

CCI-000366

Discussion

The Enterprise Admins (EA) group is a highly privileged group. To prevent forest-wide credential theft, Active Directory system administrators must strictly adhere to the principles of separation of duties and least privilege. EA group membership must be restricted to dedicated accounts used solely for forest-level management. Authenticating EA credentials on standard workstations or member servers exposes them to harvesting attacks, which can lead to complete forest compromise. Isolating administrative roles and restricting EA account usage directly mitigates these lateral movement and privilege escalation risks.

Check Content

Review the Enterprise Admins group in Active Directory Users and Computers. 
Any accounts that are members of the Enterprise Admins group must be documented with the IAO. 
Each EA must have a separate unique account specifically for managing the Active Directory forest.  

If any account listed in the Enterprise Admins group is a member of other highly privileged groups, such as the Domain Admins, Schema Admins, domain member server administrators groups (i.e., Backup Operators and Server Operators), or local workstation administrator delegation groups, this is a finding.

Fix Text

Create the necessary documentation that identifies the members of the Enterprise Admins group. 
Isolate Enterprise Admin accounts by restricting them from concurrent membership in other privileged or administrative groups. 
Ensure administrators use a separate, dedicated, and unique account reserved strictly for Active Directory Forest management.