ASD ISM 1827 Use dedicated admin accounts for domain controllers
What it says
Microsoft AD DS domain controllers are administered using dedicated domain administrator user accounts that are not used to administer other systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure domain controllers have unique admin accounts not used elsewhere for better security.
This control is about making sure that the people who manage your core computer systems have special accounts they use just for that purpose. This is important because if an intruder manages to get into these accounts, they could control your entire network. Using accounts specifically for these tasks helps limit the damage if one account is compromised.
Free. Save your status, tasks and notes.
Why it matters
If domain controllers are administered with non-dedicated accounts, compromise of that account can lead to Domain Admin control and full Active Directory takeover.
How to implement
The IT team should create separate admin accounts specifically for domain controllers.
Ensure these accounts are not used for other systems or general administrative tasks by setting them up to only access domain controller functions.
IT administrators should use these dedicated admin accounts exclusively for managing the domain controllers.
They can do this by logging into these accounts only when they need to perform tasks specifically on domain controllers.
System owners and IT managers should make it a policy that every IT admin has two accounts: a regular one for daily use and a dedicated one for managing domain controllers.
Communicate this policy clearly and ensure that everyone understands the importance of using the right account for the right task.
To further secure the dedicated admin accounts, the IT team should enable strong passwords and change them regularly.
Use password management tools to help IT staff maintain complex passwords without hassle.
IT security officers should routinely review and monitor the usage of these dedicated admin accounts.
This can be done by checking logs for any irregular access patterns or unusual login attempts, ensuring that these accounts are only used as intended.
Keep it running
Audit Domain Admin and DC logons to confirm dedicated admin accounts are used only for AD DS/domain controller administration, not email or daily user activity.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The policy document that outlines the use of dedicated admin accounts for domain controllers.
Look at
How clearly it specifies the requirement for distinct accounts and the reasons for using them.
Good evidence
Has clear instructions, responsibilities, and justifications documented.
- Check 2 of 5What an auditor asks for
Look at
The frequency of access and any unusual times or locations from which logins occur.
Good evidence
Shows consistent, regular access in line with typical admin work patterns.
- Check 3 of 5What an auditor asks for
Ask for
A list of all user accounts with admin access to domain controllers.
Look at
Accounts that have exclusive domain controller admin rights and are named or flagged distinctly.
Good evidence
Shows a short list of accounts used only for this purpose.
- Check 4 of 5What an auditor asks for
Look at
Policy details on password complexity, change frequency, and management procedures.
Good evidence
Shows robust, well-documented password policies tailored for high-security requirements.
- Check 5 of 5What an auditor asks for
Ask for
A recent audit report on domain controller access, if available.
Look at
The section that reviews compliance with dedicated account usage.
Good evidence
Shows compliance with the control and any actions taken to address deviations.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML1.2, Dedicated privileged user accounts for privileged duties, which this control covers in full and more.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.2.
Annex A 8.2 requires privileged access rights to be restricted and managed, including controlling the allocation and use of administrative credentials. ISM-1827 relates by requiring dedicated domain administrator accounts for administering domain controllers that are not used to administer other systems, reducing exposure and misuse of highly privileged credentials. ISM-1827 is a specific credential segregation practice for domain controller administration, while Annex A 8.2 is broader across all privileged roles, systems and access right types.
ASD Essential Eight: 2 mappings
This control is broader than E8-RA-ML1.2.
E8-RA-ML1.2 requires privileged users to use dedicated privileged accounts solely for admin tasks. ISM-1827 applies this concept specifically to administering Microsoft AD DS domain controllers using dedicated domain administrator accounts not used elsewhere. ISM-1827 is a system-specific instantiation of the broader E8-RA-ML1.2 requirement.
- E8-RA-ML1.7Prevent privileged user accounts from logging on to unprivileged environmentsPartially overlaps
This control partially overlaps E8-RA-ML1.7.
ISM-1827 requires dedicated domain administrator accounts for administering AD DS domain controllers, separated from accounts used to administer other systems. E8-RA-ML1.7 restricts where privileged accounts can log on by preventing privileged accounts from accessing unprivileged environments, which reduces exposure of those dedicated admin credentials. ISM-1827 focuses on account separation by system/admin purpose, while E8-RA-ML1.7 focuses on logon boundary enforcement regardless of whether accounts are dedicated.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.