ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
B.1.2 Pre-Trip Documentation
The SRR team members must make every attempt to obtain copies of the documents and
procedures listed below prior to arriving on-site. The SRR team members work with the site
POC to capture the required information to the fullest extent possible.
Documents:
a. Network diagram displaying AD architecture (forest hierarchy) including the location of
Flexible Single-Master Operations (FSMO) domain controllers. The location of premise
routers and any Intrusion Detection Systems should also be displayed.
b. Password Policy
c. List of accounts assigned to AD privileged groups including Domain Admins, Enterprise
Admins, Schema Admins, Group Policy Creator Owners, and Incoming Forest Trust
Builders
d. List of accounts that are not members of the AD privileged groups, but do have
(delegated) permission to create or change AD objects
e. List of AD trust relationships, their characteristics, and the access requirement(s) that the
trusts support
f. Trust relationship documentation
Procedures:
a. Standard Operating Procedures (SOP) for data backup
b. Supplemental INFOCON response procedures, including any AD trust-specific actions
c. Configuration management procedures that apply to AD schema updates
d. Disaster recovery procedures, including any AD-specific actions
The SRR team members will obtain copies of all listed documentation and procedures for
examination. The Team Lead or Reviewer should request the documentation from the site's POC
in any one of the following formats, listed in the order of preference:
- CD-ROM
- Diskette
- Signed, encrypted e-mail
- Paper.
UNCLASSIFIED
B-2