BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

WN11-00-000085 Standard local user accounts must not exist on a system in a domain.

DISA STIG library V2R11
All changes in this version
first version loaded CAT III

Maps to CM-6 via CCI-000366

Title

Standard local user accounts must not exist on a system in a domain.

Control

Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Users. If local users other than the accounts listed below exist on a workstation in a domain, this is a finding. The accounts listed assumes a system is joined to a domain and thus (per best practice), the local default accounts have been disabled. For standalone or nondomain-joined systems, this is Not Applicable. Built-in guest account (SID ending in 501) Built-in DefaultAccount (SID ending in 503) Built-in defaultuser0 (*SID unique per workstation) Built-in WDAGUtilityAccount (SID ending in 504) Local administrator account(s) * Note: The SID for defaultuser0 is machine-specific and immutable (cannot be changed). It will differ per Windows installation. Some of the built-in accounts may not exist on a system, depending on the Windows 11 version. Refer to WN11-SO-000280 for requirement/guidance in use of Windows LAPS to manage the built-in administrator account password.

Discussion

To minimize potential points of attack, local user accounts, other than built-in accounts and local administrator accounts, must not exist on a workstation in a domain. Users must log on to workstations in a domain with their domain accounts.

Related controls

CCI-000366

Fix

Limit local user accounts on domain-joined systems. Remove any unauthorized local accounts.