ASD ISM 1842 Use privileged accounts for domain machine addition
What it says
Dedicated privileged service accounts are used to add machines to the domain.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSpecial accounts are used for adding computers to the network for security purposes.
This control is about using special accounts with extra privileges to add computers to your network. It's like having a trusted person to do the important job of letting new devices join your secure group. If you don't use these trusted accounts, unauthorised devices could sneak in, causing data breaches or disrupting operations.
Free. Save your status, tasks and notes.
Why it matters
If non-privileged accounts can add machines to the domain, unauthorised hosts may join, enabling credential theft and lateral movement.
How to implement
The IT team should identify which accounts in the system have the special privileges needed for adding computers to the domain.
They should ensure that these accounts are used only for this purpose and are secure with strong passwords or other authentication methods.
Managers should ensure their team members understand the importance of only using these privileged accounts for adding devices.
This can be done through training sessions explaining why extra security measures are necessary.
System administrators should monitor who is using these privileged accounts and when.
They should regularly review the logs to detect any unusual activity, such as attempts to add too many devices or at odd hours.
The organisation's security manager should review the policy for using privileged accounts at least once a year.
They should check whether the guidelines are still being followed by everyone and update them to adapt to any changes in the network structure.
HR should collaborate with IT to ensure that when someone with access to these privileged accounts leaves the organisation, their access is immediately revoked to prevent any unauthorised use of the accounts.
Keep it running
Use a dedicated privileged service account for domain joins, restrict who can use it, and routinely audit domain-add events for misuse.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of privileged accounts: Request a document that identifies all accounts with the capability to add devices to the domain.
Look at
Who controls these accounts and ensure they're correctly secured.
Good evidence
Is a document listing each account, the person responsible, and the security measures applied.
- Check 2 of 5What an auditor asks for
Ask for
Training records: Request records of training sessions provided to staff about using privileged accounts.
Look at
The attendance and content details.
Good evidence
Is a complete record showing regular training with specific focus on security practices.
- Check 3 of 5What an auditor asks for
Ask for
Account usage logs: Request logs that show how and when privileged accounts have been used.
Look at
Any unusual patterns in access times or attempts to add a large number of devices.
Good evidence
Is logs with normal activity patterns and no security breaches.
- Check 4 of 5What an auditor asks for
Ask for
Policy documents: Request the current policies regarding privileged account usage.
Look at
Clear instructions on how and when these accounts should be used.
Good evidence
Is a policy document that is detailed, up-to-date, and approved by management.
- Check 5 of 5What an auditor asks for
Ask for
To see account revocation process: Request a document explaining the process for removing access when employees leave the organisation.
Look at
A detailed workflow and responsible parties.
Good evidence
Is a document that outlines a timely and secure access revocation process.
Mappings
Closest match in ISO/IEC 27001: A.8.2, Management of privileged access rights, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.2.
Annex A 8.2 requires privileged access rights to be restricted and managed so only authorised entities can perform high-impact actions. ISM-1842 relates by mandating that dedicated privileged service accounts are used to add machines to the domain, controlling and limiting a specific privileged function in Active Directory. ISM-1842 is a narrow, task-specific implementation for domain join operations, whereas Annex A 8.2 covers privileged access management holistically across functions and platforms.
ASD Essential Eight: 1 mapping
This control partially overlaps E8-RA-ML2.5.
ISM-1842 requires dedicated privileged service accounts to add machines to the domain, reducing exposure from using standard or personal admin accounts for domain join. E8-RA-ML2.5 requires strong, unique, managed credentials for service accounts (and other admin accounts), which directly strengthens the security of the domain-join service account mandated by ISM-1842. ISM-1842 focuses on account purpose separation for a specific task, while E8-RA-ML2.5 focuses on credential quality and management for those accounts.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.