ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
C.1.1 AD Domain Controller Asset Data
As noted above, the asset data for AD Domain Controllers is stored in VMS under Computing
(host) assets that are defined with a Windows server OS Asset Posture and the Domain
Controller Role.
Because Asset Posture data is captured at the time a Windows domain controller is registered in
VMS, no additional asset data needs to be entered to allow AD Domain Controller data (for an
AD implementation review) to be stored. Please refer to the appropriate appendix in the
Windows 2000 Security Checklist and the Windows Server 2003 Security Checklist documents
for details on VMS procedures for defining and accessing the asset data.
C.1.2 AD Domain Asset Data
Asset data for an AD domain is stored in VMS as a Non-Computing asset with the Asset Posture
“Active Directory Domain”. Therefore it is necessary to define a new VMS asset the first time an
AD domain is reviewed.
The following procedure describes the steps needed to access the AD domain VMS asset data.
1. Log on to the VMS application.
2. Select the Asset Finding Maint. menu item.
3. Select the Assets / Findings menu item.
4. [SAs] Expand the By Location branch, navigate to the correct location, and expand the
location.
[Reviewers] Expand the Visit branch, navigate to the correct visit, and expand the visit.
5. Expand the Non-Computing item.
6. If a new Active Directory Domain asset needs to be created:
a. Select the Create Non-Computing Asset icon.
b. Enter the asset information on the General tab:
- It is highly recommended that the format
“AD-Domain(fully-qualified-domain-name)” be used in the Display Name field
so that future automation efforts are more easily implemented. The fullyqualified-domain-name
is the DNS-style name of the domain. An example of
this format is: “AD-Domain(aofn21.disa.mil)”.
- The Classification, MAC, and Confidentiality fields should reflect the highest
levels for any of the servers or workstations that are members of the AD
domain.
c. Enter the asset information on the Systems / Enclaves tab:
- Determine the enclave in which the asset resides. For registered enclaves, select
the enclave from the Available Enclaves list. If the enclave is not present,
ensure that the IAM or Team Lead works with the appropriate site personnel to
request an enclave.
d. Enter the asset information on the Additional Details tab.
UNCLASSIFIED
C-2