Home
Security Hardening
DISA MS Windows Privileged Access Workstation V2R1

DISA MS Windows Privileged Access Workstation V2R1

WPAW-00-001200 – The domain must be configured to restrict privileged administrator accounts from logging on to lower-tier hosts – Deny log on as a batch job
Details If the domain is not configured to restrict privileged administrator accounts from logging on to lower-tier hosts, it would...
WPAW-00-000100 – Administrators of high-value IT resources must complete required training.
Details Required training helps to mitigate the risk of administrators not following required procedures. High-value IT resources are the most...
WPAW-00-001200 – The domain must be configured to restrict privileged administrator accounts from logging on to lower-tier hosts – Deny log on as a service
Details If the domain is not configured to restrict privileged administrator accounts from logging on to lower-tier hosts, it would...
WPAW-00-000200 – Site IT resources designated as high value by the Authorizing Official (AO) must be remotely managed only via a Windows privileged access workstation (PAW) – AO must be remotely managed only via PAW
Details The AO must designate which IT resources are high value. The list must include the following IT resources: –...
WPAW-00-000400 – Administrative accounts of all high-value IT resources must be assigned to a specific administrative tier in Active Directory to separate highly privileged administrative accounts from less privileged administrative accounts.
Details Note: The Microsoft Tier 0-2 AD administrative tier model (https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material#ADATM_BM) is an example. A key security construct of a...
WPAW-00-000500 – A Windows PAW must only be used to manage high-value IT resources assigned to the same tier.
Details Note: Allowed exception – For sites that are constrained in the number of available workstations, an acceptable approach is...
WPAW-00-000600 – All high-value IT resources must be assigned to a specific administrative tier to separate highly sensitive resources from less sensitive resources.
Details Note: The Microsoft Tier 0-2 AD administrative tier model (https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material#ADATM_BM) is an example. A key security construct of a...
WPAW-00-000700 – The Windows PAW must be configured with a vendor-supported version of Windows 10 and applicable security patches that are DoD approved – CurrentBuild
Details Older versions of operating systems usually contain vulnerabilities that have been fixed in later released versions. In addition, most...
WPAW-00-000700 – The Windows PAW must be configured with a vendor-supported version of Windows 10 and applicable security patches that are DoD approved – ProductName
Details Older versions of operating systems usually contain vulnerabilities that have been fixed in later released versions. In addition, most...
WPAW-00-000800 – A Windows update service must be available to provide software updates for the PAW platform – AUOptions
Details Older versions of operating systems usually contain vulnerabilities that have been fixed in later versions. In addition, most operating...

DISA MS Windows Privileged Access Workstation V2R1

WPAW-00-001200 – The domain must be configured to restrict privileged administrator accounts from logging on to lower-tier hosts – Deny log on as a batch job

WPAW-00-000100 – Administrators of high-value IT resources must complete required training.

WPAW-00-001200 – The domain must be configured to restrict privileged administrator accounts from logging on to lower-tier hosts – Deny log on as a service

WPAW-00-000200 – Site IT resources designated as high value by the Authorizing Official (AO) must be remotely managed only via a Windows privileged access workstation (PAW) – AO must be remotely managed only via PAW

WPAW-00-000400 – Administrative accounts of all high-value IT resources must be assigned to a specific administrative tier in Active Directory to separate highly privileged administrative accounts from less privileged administrative accounts.

WPAW-00-000500 – A Windows PAW must only be used to manage high-value IT resources assigned to the same tier.

WPAW-00-000600 – All high-value IT resources must be assigned to a specific administrative tier to separate highly sensitive resources from less sensitive resources.

WPAW-00-000700 – The Windows PAW must be configured with a vendor-supported version of Windows 10 and applicable security patches that are DoD approved – CurrentBuild

WPAW-00-000700 – The Windows PAW must be configured with a vendor-supported version of Windows 10 and applicable security patches that are DoD approved – ProductName

WPAW-00-000800 – A Windows update service must be available to provide software updates for the PAW platform – AUOptions