ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

More documents

Recommendations

Info

Active Directory Checklist, V1R1.2 Field Security Operations 22 September 2006 Defense Information Systems Agency This page is intentionally left blank. UNCLASSIFIED 4-2
Active Directory Checklist, V1R1.2 Field Security Operations 22 September 2006 Defense Information Systems Agency 5. MANUAL CHECK PROCEDURES This section of the Checklist describes the procedures to be used to conduct a manual review for the Active Directory STIG requirements. The results from the procedures in this section can be recorded on a copy of the Review Results Report in Section 2. 5.1 Review Process Information All of the AD domain and forest checks in this document are performed on a Windows domain controller using a Windows account that is a member of the Domain Admins security group. While it is possible to perform these checks remotely, the documented procedures assume that the reviewer is using the console of the domain controller. The checks for synchronization and maintenance products require the input and assistance of the administrator of the application. A Windows account with administrative privileges for the application is required. It is assumed that the reviewer is familiar with the tools and procedures documented in the Windows Security Checklists. While the procedures in this document are generally explicit, basic procedures such as the process for checking file system ACLs are not documented. The following tools are used during the review process and are available on all Windows domain controllers: - Windows Explorer - Microsoft Management Console (MMC) Snap-ins: - AD Users and Computers (dsa.msc) - AD Domains and Trusts (domain.msc) - AD Sites and Services (dssite.msc) - Services (services.msc) - Registry Editor - Command Prompt Invocation: - Shared resources (net share) - Directory Service Query (dsquery.exe) - Win2K3 The following tool is used during the review process and is only available if the Windows Support Tools have been installed: - Command Prompt Invocation: - Support Tools Domain Manager (netdom.exe) The following information should be available to accelerate the review process: - AD trust relationship documentation [Appendix B provides examples.] - Lists of accounts assigned to AD privileged groups (Domain Admins, Enterprise Admins, Schema Admins, Group Policy Creator Owners, and Incoming Forest Trust Builders) - List of accounts with the right to create AD objects (e.g., accounts, printers), but that are not members of the built-in AD privileged groups UNCLASSIFIED 5-1
Page 1 and 2:
ACTIVE DIRECTORY SECURITY CHECKLIST
Page 3 and 4:
Active Directory Checklist, V1R1.2
Page 5 and 6:
Page 7 and 8:
Page 9 and 10:
Page 11 and 12:
Page 13 and 14:
Page 15 and 16:
Page 17 and 18:
Page 19 and 20: Active Directory Checklist, V1R1.2
Page 69: Active Directory Checklist, V1R1.2
Page 121 and 122:
Page 123 and 124:
Page 125 and 126:
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Page 133 and 134:
Page 135 and 136:
show all

ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Create successful ePaper yourself

Delete template?

Save as template?