Trying to find a specific STIG rule that requires the deletion (not just disable) of local accounts used for credentialed scans on non-domain-joined servers once the scan is complete.

I remember this rule from years ago and I know that it exists, but I can't find it for the life of me despite picking through all the Windows OS STIGs. I can't recall if this was from an application-specific STIG though. Can anyone help me out?

accounts cybersecurity deletion domain find joined life local non picking scan scans servers windows windows os