Ensure the SharePoint setup account is configured with the minimum privileges in Active Directory.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

In Active Directory Users and Computers open the SharePoint setup account > Member Of. Verify it is a member of Domain Users only, and that no other delegated rights, services or permissions are assigned to it.

How it is fixed

Fix method: Guidance or infrastructure patch

Remove the setup account from every AD group other than Domain Users and remove any additional delegated permissions.