ASD ISM 1941 Restrict computer accounts in privileged security groups
What it says
Computer accounts are not members of the Domain Admins, Enterprise Admins or other highly privileged security groups.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure computer accounts aren't in highly privileged security groups like Domain Admins.
Computer accounts should never have the same high-level privileges as key IT personnel. If a computer account has these privileges, an attacker could use it to take control of your entire network, leading to potential data loss or business disruption.
Free. Save your status, tasks and notes.
Why it matters
If computer accounts enter privileged groups, attackers could exploit them to control your entire IT environment, leading to severe data breaches.
How to implement
IT team should review existing security groups.
Identify all accounts in high-level groups like Domain Admins to ensure no computer accounts have inappropriate access.
System administrators should establish clear policies.
Define which accounts can be added to privileged groups and ensure these are human, not computer, accounts.
IT managers should schedule regular training.
Provide staff with clear instructions on the risks of misconfiguring account privileges and avoid adding computer accounts to sensitive groups.
IT departments should use automated tools.
Set up alerts or reports to identify any changes to privileged groups and inspect these changes immediately.
Security officers should conduct quarterly audits.
Review group memberships to confirm only authorised personnel have access to high-privilege groups.
Keep it running
Regular reviews and monitoring of highly privileged groups mitigate the risk of unauthorised access, ensuring security integrity is maintained.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
a list of current members of high-privileged groups: Domain Admins, Enterprise Admins.
Look at
the member names to ensure no computer accounts are included.
Good evidence
is a list with only human user accounts.
- Check 2 of 5What an auditor asks for
Look at
a section covering who can assign accounts to privileged groups.
Good evidence
details clear restrictions and authorisation processes.
- Check 3 of 5What an auditor asks for
Ask for
logs or reports showing recent changes in group memberships. Look to confirm how often computer accounts were added to or removed from privileged groups.
Good evidence
shows zero inappropriate changes.
- Check 4 of 5What an auditor asks for
Look at
recent completion of courses or materials focusing on privilege management.
Good evidence
includes completed training logs.
- Check 5 of 5What an auditor asks for
Ask for
documentation on automated monitoring setups for group membership changes.
Look at
configuration settings and alert procedures.
Good evidence
includes documented processes for immediate alert responses.
Mappings
Closest match in ISO/IEC 27001: A.8.2, Management of privileged access rights, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.2.
ISM-1941 requires that computer accounts are not members of Domain Admins, Enterprise Admins or other highly privileged security groups. This is a specific restriction on the allocation of privileged access rights in Active Directory and contributes directly to Annex A 8.2, which requires the allocation and use of privileged access rights to be restricted and managed. Annex A 8.2 covers privileged access management for all users, systems and processes, while ISM-1941 addresses only computer account group membership.
ASD Essential Eight: 1 mapping
This control partially meets E8-RA-ML3.1.
ISM-1941 requires that computer accounts are not members of Domain Admins, Enterprise Admins or other highly privileged security groups. Keeping machine accounts out of these groups is a specific application of E8-RA-ML3.1, which limits privileged access to systems, applications and data repositories to only what users and services need for their duties. E8-RA-ML3.1 applies least privilege to all privileged access, whereas ISM-1941 targets one common misconfiguration involving computer accounts.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.