Members of the SCOM Administrators Group must be reviewed to ensure access is still required.

When people leave their roles, their group memberships are often times not updated.

From Active Directory Users and Computers, search for the group containing SCOM administrators. Review the users who are listed in this group. If any user in this group is no longer with the organization, no longer requires SCOM administration rights, or is no longer in a SCOM administration role within the organization, this is a finding.

From Active Directory Users and Computers, search for the group containing SCOM administrators. Double-click on the group and select the members tab. For each user that no longer needs rights, select the account and click the Remove button. Click OK once finished.