ASD ISM 1938 Restrict Domain Computers group in Active Directory
What it says
The Domain Computers security group does not have write or modify permissions to any Microsoft Active Directory objects.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPrevent Domain Computers from changing anything in Active Directory for security.
This control ensures that regular computers in a network domain can't make changes to the overall directory, which is like the network's map or blueprint. It's important because if any computer could alter this map, chaos could ensue, potentially leading to data loss, breaches, or unplanned outages.
Free. Save your status, tasks and notes.
Why it matters
If Domain Computers can write to AD objects, compromised PCs can alter directory settings, disrupt authentication, and enable persistence or privilege escalation.
How to implement
The IT team should review the permissions granted to the Domain Computers group.
They can do this by accessing the directory's access control settings and ensuring that write and modify permissions are not granted to this group.
The IT manager should ensure a policy is in place to prevent unauthorised changes to Active Directory by domain computers.
This can be done by regularly checking existing policies and updating them to match best practices outlined by the Australian Cyber Security Centre.
System administrators should use a tool like Active Directory Users and Computers to periodically audit permissions on sensitive objects.
This involves running a check on permissions to verify that domain computers have no more access rights than necessary.
IT security staff should set up alerts to notify them if any changes are attempted by domain computers.
This could involve configuring monitoring systems to detect and report unauthorised actions logged in Active Directory.
The compliance officer should conduct quarterly reviews to ensure this control is applied correctly.
Engaging with IT staff to confirm that procedures are followed and documented helps maintain compliance with the control.
Keep it running
Review AD ACLs to ensure Domain Computers has no write/modify rights on objects; alert on any changes and remediate by removing inherited or delegated permissions.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The permissions report for Domain Computers: Request a detailed document showing current permissions for the Domain Computers group in Active Directory.
Look at
Whether write or modify permissions are listed.
Good evidence
Is a report confirming that these permissions do not exist.
- Check 2 of 5What an auditor asks for
Ask for
Records of recent permissions audits: Request documentation of the last few audits conducted on Active Directory permissions.
Look at
Evidence of regular audit practices and methods used to verify permissions.
Good evidence
Is an audit log detailing dates, findings, and evidence of corrective actions if needed.
- Check 3 of 5What an auditor asks for
Ask for
To see the directory change alerts setup: Request evidence of alert configurations related to Active Directory changes.
Look at
Automated alerts that trigger if a domain computer attempts a prohibited action.
Good evidence
Is a screenshot or policy showing such alerts configured and operational.
- Check 4 of 5What an auditor asks for
Ask for
A policy document about Active Directory management: Request the organisation's policy document detailing management and security practices for Active Directory. Look that it includes mention of prohibiting domain computers from altering directory objects.
Good evidence
Is a policy that explicitly states permissions management practices.
- Check 5 of 5What an auditor asks for
Ask for
Training records related to directory management: Request evidence showing IT staff are trained regarding permissions management within Active Directory.
Look at
Training modules or attendance records.
Good evidence
Is documentation proving ongoing training initiatives in line with best practices.
Mappings
Closest match in ASD Essential Eight: E8-RA-ML3.1, Limit privileged access to what is necessary for duties, which this control partially meets.
ASD Essential Eight: 1 mapping
This control partially meets E8-RA-ML3.1.
ISM-1938 requires that the Active Directory "Domain Computers" group is not granted write or modify permissions to any AD objects, preventing computer accounts from making directory changes. E8-RA-ML3.1 requires privileged access across systems, applications, and data repositories to be limited to what is necessary for duties, including constraining what identities (including device accounts) can change in AD. ISM-1938 is a concrete AD permission-hardening implementation of the broader least-privilege expectation in E8-RA-ML3.1.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.