ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
5. MANUAL CHECK PROCEDURES
This section of the Checklist describes the procedures to be used to conduct a manual review for
the Active Directory STIG requirements. The results from the procedures in this section can be
recorded on a copy of the Review Results Report in Section 2.
5.1 Review Process Information
All of the AD domain and forest checks in this document are performed on a Windows domain
controller using a Windows account that is a member of the Domain Admins security
group. While it is possible to perform these checks remotely, the documented procedures
assume that the reviewer is using the console of the domain controller.
The checks for synchronization and maintenance products require the input and assistance of the
administrator of the application. A Windows account with administrative privileges for the
application is required.
It is assumed that the reviewer is familiar with the tools and procedures documented in the
Windows Security Checklists. While the procedures in this document are generally explicit,
basic procedures such as the process for checking file system ACLs are not documented.
The following tools are used during the review process and are available on all Windows domain
controllers:
- Windows Explorer
- Microsoft Management Console (MMC) Snap-ins:
- AD Users and Computers (dsa.msc)
- AD Domains and Trusts (domain.msc)
- AD Sites and Services (dssite.msc)
- Services (services.msc)
- Registry Editor
- Command Prompt Invocation:
- Shared resources (net share)
- Directory Service Query (dsquery.exe) - Win2K3
The following tool is used during the review process and is only available if the Windows
Support Tools have been installed:
- Command Prompt Invocation:
- Support Tools Domain Manager (netdom.exe)
The following information should be available to accelerate the review process:
- AD trust relationship documentation
[Appendix B provides examples.]
- Lists of accounts assigned to AD privileged groups (Domain Admins, Enterprise Admins,
Schema Admins, Group Policy Creator Owners, and Incoming Forest Trust Builders)
- List of accounts with the right to create AD objects (e.g., accounts, printers), but that are
not members of the built-in AD privileged groups
UNCLASSIFIED
5-1