Configure User Rights Assignments for Domain Controllers

Target Scope

Applicable Systems: Domain Controllers (DCs)
Operating Systems: Windows Server 2016 and above

Implementation Details

Priority: High
GPO Path / Registry Location:
- GPO Path: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment
- Registry Location: Stored inside local security database under privilege definitions.

Rationale

User Rights Assignments on Domain Controllers represent a primary defense boundary to secure Active Directory directory services (Tier 0). Restricting who can perform raw volume access, time adjustments, or credential delegations prevents local privilege hijacking.

This submodule contains individual requirement rules for each User Rights Assignment control enforced on Domain Controllers.

Legacy Impact & Compatibility

Operational Impact: Restricting privileges on Domain Controllers impacts replication, system tasks, or third-party AD monitoring agents. Thoroughly validate service accounts before deploying constraints.

Enforced User Rights Assignments on Domain Controllers

The following individual URA rules must be configured:

Sources & Compliance References

ANSSI Active Directory Hardening Guide: Protective controls baselines on Domain Controllers
Microsoft Security Baseline: User Rights Configuration specifications

REQ-DC-023 - Configure User Rights Assignments for Domain Controllers