← Back to Microsoft Windows PAW Security Technical Implementation Guide

V-243465

CAT II (Medium)

If several PAWs are set up in virtual machines (VMs) on a host server, domain administrative accounts used to manage high-value IT resources must not have access to the VM host operating system (OS) (only domain administrative accounts designated to manage PAWs should be able to access the VM host OS).

Rule ID

SV-243465r991589_rule

STIG

Microsoft Windows PAW Security Technical Implementation Guide

Version

V3R3

CCIs

CCI-000366

Discussion

The VM host OS should be protected from high-value IT resource administrators accidently or deliberately modifying the security settings of the host OS. Therefore, high-value IT resource administrators must not have the ability to perform maintenance functions on the VM host OS platform.

Check Content

Verify at least one group has been set up in Active Directory (usually Tier 0) for administrators responsible for maintaining VM host OSs (usually the same as the PAW workstation administrator's group).

Verify no administrator account or administrator account group has been assigned to both the group of VM host OS administrators and any group for administrators of high-value IT resources.

If separate VM host OS administrator groups and administrators of high-value IT resources have not been set up, this is a finding.

Fix Text

Configure the VM host OS so only domain administrative accounts designated to manage PAWs have administrative rights on the VM host OS.