ASD ISM 1844 Prevent non-controller accounts from delegating services

IT team should review all computer accounts: Go through each account in your Active Directory that's not a domain controller and check their delegations.

Make sure they don't have unnecessary permissions that allow them to act on behalf of legitimate accounts.

System administrator should update delegation settings: Ensure only domain controllers have the right to delegate services.

You can do this by accessing the properties of non-controller accounts in Active Directory and adjusting any settings that allow delegation.

Manager should schedule regular training: Ensure staff understand why only domain controllers should delegate services.

Hold a session where you explain, using examples, how improper settings can lead to security risks.

IT team should implement monitoring tools: Use monitoring tools to alert the team when a non-controller account is granted delegation rights.

This can be set up within your Active Directory system or with an external monitoring tool that flags these changes.

Security officer should establish a review policy: Set up a policy that includes regular checks on delegation settings as part of your security practices.

This policy should specify who checks, what they check, and how frequently.