Configure User Rights Assignments for PAWs

Target Scope

Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration.
Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise.

Implementation Details

Priority: High
GPO Path / Registry Location:
- GPO Path: Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment
- Registry Location: Stored inside local security database under privilege definitions.

Rationale

Enforcing strict User Rights Assignments (URAs) on PAWs limits the execution footprint of administrative helper binaries, service accounts, and logon permissions to minimize the privilege footprint and prevent administrative impersonation.

This submodule contains individual requirement rules for each User Rights Assignment control enforced on PAWs.

Legacy Impact & Compatibility

Maximum Console Isolation: Standard domain users and non-administrative services have no permission assignments on PAW consoles. Operational impact should be non-existent because PAWs are restricted to pure administrative functions.

Enforced User Rights Assignments on PAWs

The following individual URA rules must be configured:

Sources & Compliance References

ANSSI Active Directory Hardening Guide: Protective controls baselines on Privileged Access Workstations
Microsoft Security Baseline: User Rights Configuration specifications

REQ-PAW-009 - Configure User Rights Assignments for PAWs