`AC-06(10)` Prohibit Non-privileged Users from Executing Privileged Functions

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version

unchanged AC Moderate baseline High baseline part of AC-6

Title

Prohibit Non-privileged Users from Executing Privileged Functions

Control

Prevent non-privileged users from executing privileged functions.

Discussion

Privileged functions include disabling, circumventing, or altering implemented security or privacy controls, establishing system accounts, performing system integrity checks, and administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Privileged functions that require protection from non-privileged users include circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms. Preventing non-privileged users from executing privileged functions is enforced by [AC-3](#ac-3).

Assessment objective

AC-06(10) non-privileged users are prevented from executing privileged functions.

STIG rules that implement this control 111

Apple iOS/iPadOS 26 V1R3

AIOS-26-014800 CAT II Apple iOS/iPadOS 26 must be configured to disable "Auto Unlock" of the iPhone by an Apple Watch.

Apple iOS/iPadOS 27 V1R1

AIOS-27-013400 CAT II Apple iOS/iPadOS 27 must be configured to disable "Auto Unlock" of the iPhone by an Apple Watch.

Apple macOS 15 (Sequoia) V1R8

APPL-15-002069 CAT I The macOS system must require an administrator password to modify systemwide preferences.

Apple macOS 26 (Tahoe) V1R4

APPL-26-002069 CAT I The macOS system must require an administrator password to modify systemwide preferences.

Application Security and Development V6R5

APSC-DV-000500 CAT II The application must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Canonical Ubuntu 22.04 LTS V2R10

UBTU-22-431015 CAT II Ubuntu 22.04 LTS must be configured to use AppArmor.

Canonical Ubuntu 24.04 LTS V1R7

UBTU-24-100510 CAT II Ubuntu 24.04 LTS must be configured to use AppArmor.

Google Android 16 COBO Y26M10

GOOG-16-012200 CAT II Google Android 16 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)].

Google Android 17 COBO Y26M06

GOOG-17-009700 CAT II Google Android 17 must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)].

Microsoft Windows 11 V2R11

WN11-RG-000005 CAT II Default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.
WN11-SO-000167 CAT II Remote calls to the Security Account Manager (SAM) must be restricted to Administrators.
WN11-UR-000005 CAT II The "Access Credential Manager as a trusted caller" user right must not be assigned to any groups or accounts.
WN11-UR-000015 CAT I The "Act as part of the operating system" user right must not be assigned to any groups or accounts.
WN11-UR-000030 CAT II The "Back up files and directories" user right must only be assigned to the Administrators group.
WN11-UR-000035 CAT II The "Change the system time" user right must only be assigned to Administrators and Local Service.
WN11-UR-000040 CAT II The "Create a pagefile" user right must only be assigned to the Administrators group.
WN11-UR-000045 CAT I The "Create a token object" user right must not be assigned to any groups or accounts.
WN11-UR-000050 CAT II The "Create global objects" user right must only be assigned to Administrators, Service, Local Service, and Network Service.
WN11-UR-000055 CAT II The "Create permanent shared objects" user right must not be assigned to any groups or accounts.
WN11-UR-000060 CAT II The "Create symbolic links" user right must only be assigned to the Administrators group.
WN11-UR-000065 CAT I The "Debug programs" user right must only be assigned to the Administrators group.
WN11-UR-000095 CAT II The "Enable computer and user accounts to be trusted for delegation" user right must not be assigned to any groups or accounts.
WN11-UR-000100 CAT II The "Force shutdown from a remote system" user right must only be assigned to the Administrators group.
WN11-UR-000110 CAT II The "Impersonate a client after authentication" user right must only be assigned to Administrators, Service, Local Service, and Network Service.
WN11-UR-000120 CAT II The "Load and unload device drivers" user right must only be assigned to the Administrators group.
WN11-UR-000125 CAT II The "Lock pages in memory" user right must not be assigned to any groups or accounts.
WN11-UR-000140 CAT II The "Modify firmware environment values" user right must only be assigned to the Administrators group.
WN11-UR-000145 CAT II The "Perform volume maintenance tasks" user right must only be assigned to the Administrators group.
WN11-UR-000150 CAT II The "Profile single process" user right must only be assigned to the Administrators group.
WN11-UR-000160 CAT II The "Restore files and directories" user right must only be assigned to the Administrators group.
WN11-UR-000165 CAT II The "Take ownership of files or other objects" user right must only be assigned to the Administrators group.

Microsoft Windows Server 2022 V2R11

WN22-00-000170 CAT II Windows Server 2022 default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.
WN22-DC-000010 CAT I Windows Server 2022 must only allow administrators responsible for the domain controller to have Administrator rights on the system.
WN22-DC-000070 CAT I Windows Server 2022 permissions on the Active Directory data files must only allow System and Administrators access.
WN22-DC-000080 CAT I Windows Server 2022 Active Directory SYSVOL directory must have the proper access control permissions.
WN22-DC-000090 CAT I Windows Server 2022 Active Directory Group Policy objects must have proper access control permissions.
WN22-DC-000100 CAT I Windows Server 2022 Active Directory Domain Controllers Organizational Unit (OU) object must have the proper access control permissions.
WN22-DC-000110 CAT I Windows Server 2022 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions.
WN22-DC-000350 CAT II Windows Server 2022 Add workstations to domain user right must only be assigned to the Administrators group on domain controllers.
WN22-DC-000420 CAT II Windows Server 2022 Enable computer and user accounts to be trusted for delegation user right must only be assigned to the Administrators group on domain controllers.
WN22-MS-000010 CAT I Windows Server 2022 must only allow administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system.
WN22-MS-000060 CAT II Windows Server 2022 must restrict remote calls to the Security Account Manager (SAM) to Administrators on domain-joined member servers and standalone or nondomain-joined systems.
WN22-MS-000130 CAT II Windows Server 2022 Enable computer and user accounts to be trusted for delegation user right must not be assigned to any groups or accounts on domain-joined member servers and standalone or nondomain-joined systems.
WN22-UR-000010 CAT II Windows Server 2022 Access Credential Manager as a trusted caller user right must not be assigned to any groups or accounts.
WN22-UR-000020 CAT I Windows Server 2022 Act as part of the operating system user right must not be assigned to any groups or accounts.
WN22-UR-000040 CAT II Windows Server 2022 back up files and directories user right must only be assigned to the Administrators group.
WN22-UR-000050 CAT II Windows Server 2022 create a pagefile user right must only be assigned to the Administrators group.
WN22-UR-000060 CAT I Windows Server 2022 create a token object user right must not be assigned to any groups or accounts.
WN22-UR-000070 CAT II Windows Server 2022 create global objects user right must only be assigned to Administrators, Service, Local Service, and Network Service.
WN22-UR-000080 CAT II Windows Server 2022 create permanent shared objects user right must not be assigned to any groups or accounts.
WN22-UR-000090 CAT II Windows Server 2022 create symbolic links user right must only be assigned to the Administrators group.
WN22-UR-000100 CAT I Windows Server 2022 debug programs user right must only be assigned to the Administrators group.
WN22-UR-000110 CAT II Windows Server 2022 force shutdown from a remote system user right must only be assigned to the Administrators group.
WN22-UR-000120 CAT II Windows Server 2022 generate security audits user right must only be assigned to Local Service and Network Service.
WN22-UR-000130 CAT II Windows Server 2022 impersonate a client after authentication user right must only be assigned to Administrators, Service, Local Service, and Network Service.
WN22-UR-000140 CAT II Windows Server 2022 increase scheduling priority: user right must only be assigned to the Administrators group.
WN22-UR-000150 CAT II Windows Server 2022 load and unload device drivers user right must only be assigned to the Administrators group.
WN22-UR-000160 CAT II Windows Server 2022 lock pages in memory user right must not be assigned to any groups or accounts.
WN22-UR-000180 CAT II Windows Server 2022 modify firmware environment values user right must only be assigned to the Administrators group.
WN22-UR-000190 CAT II Windows Server 2022 perform volume maintenance tasks user right must only be assigned to the Administrators group.
WN22-UR-000200 CAT II Windows Server 2022 profile single process user right must only be assigned to the Administrators group.
WN22-UR-000210 CAT II Windows Server 2022 restore files and directories user right must only be assigned to the Administrators group.
WN22-UR-000220 CAT II Windows Server 2022 take ownership of files or other objects user right must only be assigned to the Administrators group.

Microsoft Windows Server 2025 V1R4

WN25-00-000170 CAT II Windows Server 2025 default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.
WN25-DC-000010 CAT I Windows Server 2025 must only allow administrators responsible for the domain controller to have Administrator rights on the system.
WN25-DC-000070 CAT I Windows Server 2025 permissions on the Active Directory data files must only allow system administrators (SAs) access.
WN25-DC-000080 CAT I Windows Server 2025 Active Directory SYSVOL directory must have the proper access control permissions.
WN25-DC-000090 CAT I Windows Server 2025 Active Directory (AD) Group Policy Objects (GPOs) must have proper access control permissions.
WN25-DC-000100 CAT I Windows Server 2025 Active Directory Domain Controllers Organizational Unit (OU) object must have the proper access control permissions.
WN25-DC-000110 CAT I Windows Server 2025 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions.
WN25-DC-000350 CAT II The Windows Server 2025 "Add workstations to domain" user right must only be assigned to the Administrators group on domain controllers.
WN25-DC-000420 CAT II The Windows Server 2025 "Enable computer and user accounts to be trusted for delegation" user right must only be assigned to the Administrators group on domain controllers.
WN25-MS-000010 CAT I Windows Server 2025 must only allow administrators responsible for the member server or stand-alone or nondomain-joined system to have Administrator rights on the system.
WN25-MS-000060 CAT II Windows Server 2025 must restrict remote calls to the Security Account Manager (SAM) to Administrators on domain-joined member servers and stand-alone or nondomain-joined systems.
WN25-MS-000130 CAT II The Windows Server 2025 "Enable computer and user accounts to be trusted for delegation" user right must not be assigned to any groups or accounts on domain-joined member servers and stand-alone or nondomain-joined systems.
WN25-UR-000010 CAT II The Windows Server 2025 "Access Credential Manager as a trusted caller" user right must not be assigned to any groups or accounts.
WN25-UR-000020 CAT I The Windows Server 2025 "Act as part of the operating system" user right must not be assigned to any groups or accounts.
WN25-UR-000040 CAT II The Windows Server 2025 "Back up files and directories" user right must only be assigned to the Administrators group.
WN25-UR-000050 CAT II The Windows Server 2025 "Create a pagefile" user right must only be assigned to the Administrators group.
WN25-UR-000060 CAT I The Windows Server 2025 "Create a token object" user right must not be assigned to any groups or accounts.
WN25-UR-000070 CAT II The Windows Server 2025 "Create global objects" user right must only be assigned to Administrators, Service, Local Service, and Network Service.
WN25-UR-000080 CAT II The Windows Server 2025 "Create permanent shared objects" user right must not be assigned to any groups or accounts.
WN25-UR-000090 CAT II The Windows Server 2025 "Create symbolic links" user right must only be assigned to the Administrators group.
WN25-UR-000100 CAT I The Windows Server 2025 "Debug programs" user right must only be assigned to the Administrators group.
WN25-UR-000110 CAT II The Windows Server 2025 "Force shutdown from a remote system" user right must only be assigned to the Administrators group.
WN25-UR-000120 CAT II The Windows Server 2025 "Generate security audits" user right must only be assigned to Local Service and Network Service.
WN25-UR-000130 CAT II The Windows Server 2025 "Impersonate a client after authentication" user right must only be assigned to Administrators, Service, Local Service, and Network Service.
WN25-UR-000140 CAT II The Windows Server 2025 "Increase scheduling priority" user right must only be assigned to the Administrators group.
WN25-UR-000150 CAT II The Windows Server 2025 "Load and unload device drivers" user right must only be assigned to the Administrators group.
WN25-UR-000160 CAT II The Windows Server 2025 "Lock pages in memory" user right must not be assigned to any groups or accounts.
WN25-UR-000180 CAT II The Windows Server 2025 "Modify firmware environment values" user right must only be assigned to the Administrators group.
WN25-UR-000190 CAT II The Windows Server 2025 "Perform volume maintenance tasks" user right must only be assigned to the Administrators group.
WN25-UR-000200 CAT II The Windows Server 2025 "Profile single process" user right must only be assigned to the Administrators group.
WN25-UR-000210 CAT II The Windows Server 2025 "Restore files and directories" user right must only be assigned to the Administrators group.
WN25-UR-000220 CAT II The Windows Server 2025 "Take ownership of files or other objects" user right must only be assigned to the Administrators group.

Red Hat Enterprise Linux 10 V1R3

RHEL-10-200590 CAT II RHEL 10 must have the "sudo" package installed.
RHEL-10-700410 CAT II RHEL 10 must elevate the SELinux context when an administrator calls the sudo command.
RHEL-10-700950 CAT I RHEL 10 must disable the systemd Ctrl-Alt-Delete burst key sequence.
RHEL-10-700960 CAT I RHEL 10 must disable the x86 Ctrl-Alt-Delete key sequence.
RHEL-10-700970 CAT II RHEL 10 must disable the debug-shell systemd service.
RHEL-10-701070 CAT II RHEL 10 must enable kernel parameters to enforce discretionary access control (DAC) on hardlinks.
RHEL-10-701080 CAT II RHEL 10 must enable kernel parameters to enforce discretionary access control (DAC) on symlinks.

Red Hat Enterprise Linux 9 V2R10

RHEL-09-211045 CAT I The systemd Ctrl-Alt-Delete burst key sequence in RHEL 9 must be disabled.
RHEL-09-211050 CAT I The x86 Ctrl-Alt-Delete key sequence must be disabled on RHEL 9.
RHEL-09-211055 CAT II RHEL 9 debug-shell systemd service must be disabled.
RHEL-09-213030 CAT II RHEL 9 must enable kernel parameters to enforce discretionary access control (DAC) on hardlinks.
RHEL-09-213035 CAT II RHEL 9 must enable kernel parameters to enforce discretionary access (DAC) control on symlinks.
RHEL-09-431016 CAT II RHEL 9 must elevate the SELinux context when an administrator calls the sudo command.
RHEL-09-432010 CAT II RHEL 9 must have the sudo package installed.

Samsung Android 16 COBO Y26M10

KNOX-16-006000 CAT I Samsung Android must be configured to enable encryption for data at rest on removable storage media or, alternately, the use of removable storage media must be disabled.
KNOX-16-010300 CAT II The Samsung Android device must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)].

AC-06(10) Prohibit Non-privileged Users from Executing Privileged Functions