ASD ISM 1841 Restrict domain joining to admin users only
What it says
Unprivileged user accounts cannot add machines to the domain.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly authorised users can add computers to the network to maintain security.
This rule ensures that only the right people, usually the IT folks with special permissions, can connect new computers to your company's network. It matters because if anyone could add devices, it could allow hackers to sneak in with unsafe computers and potentially cause data breaches or system failures.
Free. Save your status, tasks and notes.
Why it matters
Allowing unprivileged users to join devices can add untrusted hosts to the domain, enabling unauthorised access and increasing malware risk.
How to implement
IT Manager should identify authorised personnel: Make a list of who in the IT team is allowed to add computers to the network.
This list should only include people with the right skills and trust level.
System Administrator should configure settings: Adjust the network settings so that only accounts with admin rights can add new devices.
This typically involves setting permissions in the Active Directory panel.
HR should coordinate with IT for departures: When someone leaves the organisation, ensure that their admin rights are evaluated and revoked if necessary.
Communicate clearly with IT to maintain updated access controls.
Management should support IT policy updates: Approve and promote the policy that states only authorised users can add devices to the network.
Make sure everyone understands why this rule is crucial for security.
IT Team should provide training: Educate authorised users on the process of adding devices and the security risks involved.
Regularly update this training to include any new security measures or technological changes.
Keep it running
Audit domain-join rights (e.g., AD 'Add workstations to domain') and restrict to approved admin groups; monitor domain-join events for misuse.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The list of authorised users: Request to see the document or system record showing who is permitted to join devices to the domain.
Look at
Permission settings: Check the settings in Active Directory and ensure only these users have the 'Domain Join' rights.
Good evidence
The list should match the permissions in the system, with documented approvals for each user.
- Check 2 of 4What an auditor asks for
Ask for
Policy documents: Request the written policy that outlines this access restriction.
Look at
The policy enforcement: Verify that the organisation has a review process and see evidence of training provided.
Good evidence
A clear policy document, recent training records, and a regular review schedule.
- Check 3 of 4What an auditor asks for
Ask for
A recent access review report: Request a report showing when permissions were last checked and updated.
Look at
Review actions: Ensure that any changes in personnel are matched by changes in permissions.
Good evidence
The report shows timely updates with resolved any discrepancies.
- Check 4 of 4What an auditor asks for
Ask for
Logs of device joins: Request logs that show who added what devices to the network.
Look at
Log details: Logs should show authorised users performing device additions, with no unauthorised actions.
Good evidence
Logs only show authorised users performing actions relevant to their roles.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.15.
ISM-1841 requires restricting the ability to join computers to a domain so that unprivileged users cannot perform domain joins. Annex A 5.15 requires organisations to define and implement access control policies and procedures for logical (and physical) access based on business and security requirements. ISM-1841 is a specific technical/policy rule that would typically be implemented under the broader access control policy framework required by Annex A 5.15.
This control partially meets A.8.3.
ISM-1841 requires that only authorised users can add computers to the domain, preventing unprivileged accounts from joining machines. Annex A 8.3 requires restricting access to information and associated assets in accordance with an established access control policy, which includes controlling administrative actions on directory services and endpoints. ISM-1841 is a concrete restriction on a specific administrative capability, whereas Annex A 8.3 is a general access restriction requirement across many asset types and actions.
This control depends on A.5.18.
ISM-1841 requires that only authorised users can join devices to the domain, which is an access right that must be tightly controlled. Annex A 5.18 requires provisioning, reviewing, modifying, and removing access rights in line with access control rules, which is the process used to ensure only the correct admin accounts retain domain join rights. ISM-1841 defines the specific restriction outcome, while Annex A 5.18 focuses on the lifecycle management processes that keep that restriction accurate over time.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.