ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
3.3 Active Directory Domain
Notes: The checks in this section apply to Active Directory Domain assets and are performed
only once per AD domain, on any one domain controller.
DS10.0260 AD Object Ownership Delegation
STIG ID \ V-Key DS10.0260 \ V0008521
Severity Cat II
Short Name AD Object Ownership Delegation
IA Controls ECLP-1, ECPA-1
MAC /Conf 1-CSP, 2-CSP, 3-CSP
References AD STIG 2.3.3.6
Long Name: The number of accounts is excessive or documentation does not exist for the
accounts that have been delegated AD object ownership or update permissions
and are *not* members of Windows built-in administrative groups.
Checks:
• Interview the IAM.
• Obtain the list of accounts that have been delegated AD object ownership or
update permissions and that are *not* members of Windows built-in
administrative groups.
[This includes accounts for help desk or support personnel who are not
Administrators, but have authority in AD to maintain user accounts or printers.]
• If accounts with delegated authority are defined and there is no list, then this is a
Finding.
• Count the number of accounts on the list.
• If the number of accounts with delegated authority is greater than ten (10), review
the site documentation that justifies this number.
- The object is to validate that the IAM explicitly acknowledges the need to have
a high number of privileged users.
• If the number of accounts with delegated authority is greater than ten (10) and
there is no statement in the documentation that justifies the number, then this is a
Finding.
UNCLASSIFIED
3-5