ASD ISM 1845 Disable user security group access in Active Directory
What it says
When a user account is disabled, it is removed from all security group memberships.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWhen a user is disabled, they lose access to all security groups.
Disabling a user's account in Active Directory means they will automatically lose access to all the security groups they were part of. This is important because leaving their access active, even when they no longer work for the organisation, can be a security risk, such as unauthorised access to sensitive information.
Free. Save your status, tasks and notes.
Why it matters
Inactive user accounts retaining AD security group memberships can enable unauthorised access to systems and data, increasing breach risk.
How to implement
The IT team should ensure they have a clear process for disabling user accounts.
This involves quickly removing access for users who have left the organisation by updating the user's status in Active Directory.
HR should notify IT as soon as an employee leaves the organisation.
They can do this by sending an exit notice which includes the departure date, ensuring that the IT team disables the account promptly.
System owners should review security group memberships to confirm no disabled accounts remain.
They can accomplish this by generating regular reports from Active Directory that show current group memberships and comparing them with active employee lists.
Managers should be made aware of the importance of reporting staff changes.
They can facilitate this by including an agenda item in regular team meetings to discuss upcoming departures.
The IT team should regularly audit user accounts to identify any discrepancies.
This involves a routine check to ensure accounts marked as disabled do not retain access to any groups, potentially using Active Directory audit tools.
Keep it running
When disabling a user in Active Directory, confirm they are removed from all security groups and regularly audit disabled accounts for lingering memberships.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of disabled accounts: Request a report from the IT team showing all user accounts currently marked as disabled.
Look at
The date the accounts were disabled and cross-reference with HR records.
Good evidence
Is that all listed disabled accounts have corresponding departure dates and no active group memberships.
- Check 2 of 5What an auditor asks for
Ask for
HR for records of all exit notices sent to IT in a given period.
Look at
Dates, employee names, and acknowledgment from IT.
Good evidence
Is timestamped notifications with matching records in the IT system for account disabling.
- Check 3 of 5What an auditor asks for
Ask for
To see a sample security group membership report: Obtain a copy of a report from the IT team enumerating security group members.
Look at
Any entries with disabled accounts.
Good evidence
Shows no disabled user accounts in listed groups.
- Check 4 of 5What an auditor asks for
Ask for
About the process for account disabling: Request written procedures that outline how accounts are to be disabled.
Look at
Clear steps including timelines and responsibilities.
Good evidence
Includes a documented process with roles clearly defined and steps detailed.
- Check 5 of 5What an auditor asks for
Ask for
The training records on account management: Ensure staff are trained on the importance of user account security.
Look at
Evidence of recent training dates and participant lists.
Good evidence
Includes recent training sessions with key HR and IT personnel listed.
Mappings
Closest match in ISO/IEC 27001: A.5.16, Identity life cycle management, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.16.
Annex A 5.16 requires organisations to manage identities through to deactivation, ensuring access paths are removed when an account is disabled. ISM-1845 provides a specific deprovisioning step in Active Directory: removing disabled users from all security group memberships to prevent residual authorisations. ISM-1845 is a narrow technical requirement for group membership clean-up, while Annex A 5.16 covers the wider identity lifecycle including provisioning, modification and review across systems.
This control partially meets A.5.18.
ISM-1845 mandates automatic removal of security group memberships when a user account is disabled to ensure access rights are promptly revoked. Annex A 5.18 requires access rights to be provisioned, reviewed, modified and removed in accordance with access control rules and policies. ISM-1845 is one concrete mechanism for the 'removed/modified' part of access-rights management, while Annex A 5.18 applies to all systems and access types, not just AD security groups.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.