ASD ISM 1846 Restrict Pre-Windows 2000 access group membership
What it says
The Pre-Windows 2000 Compatible Access security group does not contain user accounts.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure no user accounts are added to the obsolete security group for better system security.
This control is about ensuring that outdated security rules aren't used in your computer systems. If you leave these outdated rules in place, it could make it easier for someone to get unauthorised access to sensitive information or parts of your computer network. This could put your organisation's data and operations at risk.
Free. Save your status, tasks and notes.
Why it matters
Leaving users in the Pre-Windows 2000 Compatible Access group can allow broad legacy read access, increasing risk of unauthorised data exposure.
How to implement
IT Manager should work with the IT team to review current user account group memberships.
Gather a list of all user accounts associated with the security groups in your Active Directory system, focusing on the 'Pre-Windows 2000 Compatible Access' group.
System Administrator should remove any user accounts from the outdated security group.
In Active Directory, locate the 'Pre-Windows 2000 Compatible Access' group and ensure it is empty. If user accounts are present, remove them to improve security.
IT Security Officer should conduct a regular audit to ensure compliance.
Use directory management tools to double-check that no user accounts have been added to the group mistakenly over time.
HR team should coordinate with IT when new employees are onboarded or offboarded.
Ensure that group memberships are correctly assigned and reviewed during these transitions to prevent unnecessary access.
IT Support Staff should train users on the importance of avoiding legacy systems and security configurations.
Conduct informational sessions explaining why certain security practices are outdated and how they impact security.
Keep it running
Periodically query Active Directory for members of the Pre-Windows 2000 Compatible Access group and remove any user accounts so the group remains empty.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
The directory group membership report: Request a report showing all memberships of the 'Pre-Windows 2000 Compatible Access' security group.
Look at
The list of members in the report. Ensure there are no user accounts listed.
Good evidence
The group should be empty, indicating compliance with the control.
- Check 2 of 3What an auditor asks for
Ask for
The security review records: Request records of any reviews or audits conducted on Active Directory group memberships.
Look at
The frequency and findings of these reviews.
Good evidence
Review will be recent and indicate corrections were made where necessary.
- Check 3 of 3What an auditor asks for
Ask for
Training materials provided to IT staff about managing Active Directory groups.
Look at
Content coverage in the training documents to ensure 'Pre-Windows 2000 Compatible Access' group restrictions are included.
Good evidence
Materials detail removing accounts from this group as a best practice.
Mappings
Closest match in ISO/IEC 27001: A.5.18, Managing access rights to information assets, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.18.
ISM-1846 requires organisations to ensure the Pre-Windows 2000 Compatible Access group does not include user accounts, effectively enforcing a specific access-rights removal for a legacy group. This aligns with Annex A 5.18, which requires access rights to be provisioned, reviewed, modified and removed under defined rules. Annex A 5.18 governs the full access-rights lifecycle broadly, while ISM-1846 is a focused technical rule for one Active Directory security group.
This control partially meets A.8.2.
ISM-1846 requires that the Pre-Windows 2000 Compatible Access group has no user accounts, removing an obsolete mechanism that can grant overly broad directory read access. This is a specific implementation of Annex A 8.2 (management of privileged access rights) because it constrains and manages a high-impact access assignment within Active Directory. Annex A 8.2 is broader, covering allocation and use of privileged rights generally across systems, not just this single legacy group.
This control partially meets A.8.3.
ISM-1846 requires removal/prevention of user accounts in the Pre-Windows 2000 Compatible Access group to restrict unintended access arising from legacy compatibility settings. This is a specific instance of Annex A 8.3, which requires restricting access to information and assets in line with an access control policy. Annex A 8.3 is broader and policy-driven across many asset types, whereas ISM-1846 targets one well-known Windows group membership configuration.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.