Members of the SCOM Administrators Group must be reviewed to ensure access is still required.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-237423	SCOM-AC-000001	SV-237423r643915_rule		Medium

Description

When people leave their roles, their group memberships are often times not updated.

STIG	Date
Microsoft SCOM Security Technical Implementation Guide	2021-03-15

Details

Check Text (C-40642r643913_chk)

From Active Directory Users and Computers, search for the group containing SCOM administrators. Review the users who are listed in this group. If any user in this group is no longer with the organization, no longer requires SCOM administration rights, or is no longer in a SCOM administration role within the organization, this is a finding.

Fix Text (F-40605r643914_fix)

From Active Directory Users and Computers, search for the group containing SCOM administrators. Double-click on the group and select the members tab. For each user that no longer needs rights, select the account and click the Remove button. Click OK once finished.