ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
APPENDIX C: VMS PROCESS GUIDANCE
This appendix provides guidance for entering and accessing the asset information in VMS for the
items covered by the Checklist. There are three review subjects covered in the Checklist:
- Active Directory Implementation - This subject covers checks for AD Domain
Controllers, AD Domains, and the AD Forest that make up an implementation of Active
Directory.
- Synchronization\Maintenance Application - This subject covers checks for an individual
installation of an application used to perform synchronization or maintenance on one or
more Active Directory implementations.
- ADAM - This subject covers checks for an individual installation of ADAM as a
directory service.
To understand how to access the VMS data, it is helpful to know how the data is organized. The
following table summarizes this VMS data organization.
Review Subject Items Included VMS
VMS
Asset Data Organization Asset Type
Active Directory AD Domain Controller Windows server OS Asset Posture Computing
Implementation
with Domain Controller Role
AD Domain Active Directory Domain Asset Non-Computing
AD Forest Active Directory Forest Asset Non-Computing
Synch\Maint
Application
Synch\Maint Application Synch\Maint App Asset Posture Computing
ADAM ADAM Instance ADAM Instance Asset Posture Computing
Note: The path used to access asset data in the VMS application depends on the assigned role of
the user:
- System Administrators (SAs) use the Asset Finding Maint. item on the VMS menu,
select the Assets / Findings item, and navigate to assets under the By Location branch.
- Reviewers use the Asset Finding Maint. item on the VMS menu, select the Assets /
Findings item, and navigate to assets under the Visit branch.
Because this is the significant detail in which the procedures vary between SAs and
Reviewers, a single set of procedures is defined here and variations are noted where relevant.
C.1 AD Implementation Data - AD Domain Controller, AD Domain, AD Forest
AD implementation data is expressed in VMS through three categories:
- The AD Domain Controller category is not explicitly defined in VMS. Rather, to take
advantage of the existing VMS data, the asset data for AD Domain Controllers is stored
under assets that are defined with a Windows server OS Asset Posture and the Domain
Controller Role.
- AD Domain asset data is stored though the definition of an “Active Directory Domain”
Non-Computing asset in VMS.
- AD Forest asset data is stored though the definition of an “Active Directory Forest”
Non-Computing asset in VMS.
UNCLASSIFIED
C-1