ASD ISM 1942 Domain Computers group privilege restriction
What it says
The Domain Computers security group is not a member of any privileged or highly privileged security groups.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe Domain Computers group should not have any privileged access to maintain security.
This control ensures that computers in a network don't have special access to sensitive areas. If this isn't done, malicious people could exploit those computers to steal data or cause harm.
Free. Save your status, tasks and notes.
Why it matters
Without this control, computers in the network could be hijacked to access sensitive information, leading to security breaches and data loss.
How to implement
IT team should review the membership of the Domain Computers group.
Use user management tools to ensure it doesn't have privileged access.
System owner must confirm that no computers have been added to high-level groups.
Check configurations monthly and document findings.
IT administrator should use monitoring tools to track changes.
Set alerts for any change to the Domain Computers group's permissions.
Managers should request regular security briefings from IT.
Discuss the importance of keeping computers out of privileged groups and understand potential impacts.
Audit staff should schedule routine checks.
Use checklists to verify Domain Computers is limited to non-privileged access.
Keep it running
Regularly review and update security group policies to maintain restrictions on the Domain Computers group, preventing unauthorised access.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
a listing of current security group memberships.
Look at
group memberships to ensure Domain Computers isn't part of privileged groups.
Good evidence
A list showing Domain Computers in only basic access groups.
- Check 2 of 5What an auditor asks for
Good evidence
Logs showing change history with authorised approvals.
- Check 3 of 5What an auditor asks for
Ask for
to see permissions granted to the Domain Computers group.
Look at
excessive permissions beyond standard computer needs.
Good evidence
Access levels appropriate only for basic machine operations.
- Check 4 of 5What an auditor asks for
Look at
specific mention of Domain Computer group restrictions.
Good evidence
Policy clearly stating Domain Computers cannot join privileged groups.
- Check 5 of 5What an auditor asks for
Ask for
a recent internal audit report on access management. Examine findings related to Domain Computers.
Good evidence
Audit confirms no unauthorised privileged group access.
Mappings
Closest match in ISO/IEC 27001: A.8.2, Management of privileged access rights, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.2.
ISM-1942 requires that the Active Directory Domain Computers group is not a member of any privileged or highly-privileged security groups. This relates directly to Annex A 8.2, which requires organisations to restrict and manage the allocation and use of privileged access rights (including through group membership). Annex A 8.2 is broader, covering the full lifecycle and governance of privileged access, while ISM-1942 is a specific directory-group hygiene constraint aimed at preventing unintended privilege for computer accounts.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.