ISM-1941policyASD Information Security Manual (ISM)

Restrict Computer Accounts in Privileged Security Groups

Ensure computer accounts aren't in highly privileged security groups like Domain Admins.

Preventative NC OS PASD Information Security ManualGuidelines for system hardening Admin accounts Access control

record_voice_over

Plain language

Computer accounts should never have the same high-level privileges as key IT personnel. If a computer account has these privileges, an attacker could use it to take control of your entire network, leading to potential data loss or business disruption.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

June 2026

Control Stack last updated

18 June 2026

E8 maturity levels

N/A

Guideline

Guidelines for system hardening

Section

Server Application Hardening

Topic

Microsoft Active Directory Domain Services Security Group Memberships

Official control statement

Computer accounts are not members of the Domain Admins, Enterprise Admins or other highly privileged security groups.

policyASD Information Security Manual (ISM)ISM-1941

priority_high

Why it matters

If computer accounts enter privileged groups, attackers could exploit them to control your entire IT environment, leading to severe data breaches.

settings

Operational notes

Regular reviews and monitoring of highly privileged groups mitigate the risk of unauthorised access, ensuring security integrity is maintained.

02 - Implement

build

Implementation tips

IT team should review existing security groups. Identify all accounts in high-level groups like Domain Admins to ensure no computer accounts have inappropriate access.
System administrators should establish clear policies. Define which accounts can be added to privileged groups and ensure these are human, not computer, accounts.
IT managers should schedule regular training. Provide staff with clear instructions on the risks of misconfiguring account privileges and avoid adding computer accounts to sensitive groups.
IT departments should use automated tools. Set up alerts or reports to identify any changes to privileged groups and inspect these changes immediately.
Security officers should conduct quarterly audits. Review group memberships to confirm only authorised personnel have access to high-privilege groups.

03 - Audit

fact_check

Audit / evidence tips

Aska list of current members of high-privileged groups: Domain Admins, Enterprise AdminsLook atthe member names to ensure no computer accounts are includedGoodis a list with only human user accounts
Look ata section covering who can assign accounts to privileged groupsGooddetails clear restrictions and authorisation processes
Asklogs or reports showing recent changes in group memberships. Look to confirm how often computer accounts were added to or removed from privileged groupsGoodshows zero inappropriate changes
Look atrecent completion of courses or materials focusing on privilege managementGoodincludes completed training logs
Askdocumentation on automated monitoring setups for group membership changesLook atconfiguration settings and alert proceduresGoodincludes documented processes for immediate alert responses