ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
DS15.0110 ADAM Service Account
STIG ID \ V-Key DS15.0110 \ V0008344
Severity Cat II
Short Name ADAM Service Account
IA Controls ECLP-1
MAC /Conf 1-CSP, 2-CSP, 3-CSP
References AD STIG 2.3.3.6
Long Name: An ADAM service account is a member of a Windows built-in administrative
group.
Checks:
A. Determine ADAM service accounts
• Start the Services console (“Start”, “Run…”, “services.msc”)
• Identify the individual services for ADAM instances.
These names are usually of the form “ADAM_instance”, where instance is the
name chosen during installation.
• For *each* ADAM instance service:
- Note the entry in the LogOnAs field.
• If the service account used for all ADAM instances is the Network Service
account, then there is *no* Finding.
B. Check ADAM service accounts group membership
• For *each* ADAM service account that is a local (*not* domain) user account,
- At a command line prompt enter: “net user account”
where account is the ADAM service account.
- Note the Group Membership information.
• For *each* ADAM service account that is a domain user account,
- At a command line prompt enter: “net user account /domain”
where account is the ADAM service account.
- Note the Group Membership information.
• If any ADAM service account is a member of the Administrators, Domain
Admins, Enterprise Admins, or Schema Admins groups, then this is a finding.
UNCLASSIFIED
5-44