AU.2.002 — Ensure User Accountability Through Unique Identifiers

What AU.2.002 means in plain English

Every person at your shop must have their own unique Windows login—no shared accounts like "shop_user" or "admin." When Event Viewer shows that someone deleted a file at 11 PM on a Friday, you need to know exactly which employee it was. Shared accounts make it impossible to hold anyone accountable and will cause an automatic CMMC failure. This also means each person logs out when they leave a machine—no leaving a session open for the next person.

The assessment question

“Does every individual who accesses systems containing CUI have a unique, personally assigned user account, with no shared credentials in use?”

How to implement AU.2.002

1. Audit all current Windows accounts: open Computer Management > Local Users and Groups and list every account. Identify any shared or generic accounts (e.g., "admin," "shop," "machinist") and document who uses them.
2. Create individual named accounts for every employee: format as firstname.lastname or first initial + last name (e.g., j.smith). Assign each person to appropriate groups (Users group for standard staff, Administrators only for IT-responsible personnel).
3. Disable or delete all shared/generic accounts after migrating each person to their individual account. If a generic account is needed for a specific application, document the business justification and ensure it is not used for interactive login.
4. Enforce account uniqueness with Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > enable "Interactive logon: Do not display last user name" and configure screen lock after 15 minutes of inactivity.
5. Document all current user accounts with an account inventory spreadsheet: columns for Account Name, Full Name, Role, Date Created, and Account Type (standard/admin).

Evidence your assessor will ask for

• Account inventory spreadsheet listing all user accounts with assigned individual
• Screenshot from Computer Management or Active Directory showing only individually named accounts
• Documentation that shared/generic interactive accounts have been disabled
• Group Policy settings showing account lockout and session timeout policies
• Sample audit log entry demonstrating individual user attribution (e.g., logon event showing a specific username)

More Audit & Accountability controls