Local users must not exist on a system in a domain.

From Windows 7 Security Technical Implementation Guide

Part of Local Users Exist on a Workstation

Associated with: CCI-000366

SV-25214r2_rule Local users must not exist on a system in a domain.

Vulnerability discussion

To minimize potential points of attack, local users, other than built-in accounts such as Administrator and Guest accounts, should not exist on a workstation in a domain. Users must always log onto workstations in a domain with their domain accounts.

Check content

Run the DUMPSEC utility. Select "Dump Users as Table" from the "Report" menu. Select the following fields, and click "Add" for each entry: UserName SID AcctDisabled Groups If local users other than the built-in accounts listed below exist on a workstation in a domain, this is a finding: Built-in administrator account (SID ending in 500) Built-in guest account (SID ending in 501) If the organization has a need for special purpose local user accounts such as a backup administrator account (see V-14224), this must be documented with the ISSO. This would not be a finding.

Fix text

Limit local user accounts on domain-joined systems. Remove any unauthorized local accounts.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.