The default Builtin\Administrators group must be removed from the SCOM Administrators Role Group.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-237437	SCOM-IA-000003	SV-237437r643957_rule		Medium

Description

SCOM servers with default well-known operating system groups defined the SCOM Administrators Global Group may allow a local administrator access to privileged SCOM access.

STIG	Date
Microsoft SCOM Security Technical Implementation Guide	2021-03-15

Details

Check Text (C-40656r643955_chk)

Review the SCOM Administrators Global Group and verify that the Built-in\Administrators Group is not a member.

If the Built-in\Administrators group is a member, this is a finding.

Fix Text (F-40619r643956_fix)

Remove the Built-in\Administrators group from the SCOM Administrators Role Group.