ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

More documents

Recommendations

Info

Active Directory Checklist, V1R1.2 Field Security Operations 22 September 2006 Defense Information Systems Agency - Locations of AD domain controllers and AD sites, relative to the local Enclave network boundaries - Location of the AD forest root PDC Emulator FSMO domain controller - Presence of any Windows NT and Windows Server 2003 domain controllers operating in the AD domain. Please note that it would be significantly more efficient to gather this information prior to the start of a review. Appendix B Section B.1, Pre-Trip Information Gathering, provides lists of interview questions and documentation items that should be used in advance to assemble the required information. Please reference Appendix D, Directory Information Gathering, for tools and procedures that can be used to gather some of the information required for a review. In particular, Section D.1.3, Identifying Holders of FSMO Roles, can be used to gather the current FSMO information for the AD environment. UNCLASSIFIED 5-2
Active Directory Checklist, V1R1.2 Field Security Operations 22 September 2006 Defense Information Systems Agency 5.2 Active Directory Domain Controller Notes: The checks in this section apply to assets with a Windows server OS and the Domain Controller role and are performed for all domain controllers selected for review in an AD domain. [This may be a sample of one or more domain controllers.] 2.4.6 Data \ Program Access Control The checks in this section address access control for the AD data files and the Windows Support Tools that may update those files. DS00.0120 Directory Data File Access Permissions STIG ID \ V-Key DS00.0120 \ V0008316 Severity Cat I Short Name Directory Data File Access Permissions IA Controls ECAN-1, ECCD-1, ECCD-2 MAC /Conf 1-CS, 2-CS, 3-CSP References AD STIG 2.3.3.3 Long Name: Directory service data files do not have proper access permissions (ACLs). Checks: • Use Registry Editor to navigate to the following: HKLM\System\CurrentControlSet\Services\NTDS\Parameters. • Note the values for: - DSA Database file - Database log files path - DSA Working Directory. • Using the noted locations, compare the ACLs of the AD database, log, and work files to the specifications in Checklist appendix A.1.1. • If the actual permissions are not at least as restrictive as those in the appendix, then this is a Finding. • Use Registry Editor to navigate to the following: HKLM\System\CurrentControlSet\Services\NtFrs\Parameters. • Note the value for: Working Directory. • Using the noted location, compare the ACL of the FRS directory to the specifications in Checklist appendix A.1.1. • If the actual permissions are not at least as restrictive as those in the appendix, then this is a Finding. • At a command line prompt enter “net share”. • Note the location for the SYSVOL share. • Using the noted location, compare the ACLs of the GPT directories (GPT parent and GPT Policies directories) to the specifications in Checklist appendix A.1.1. • If the actual permissions are not at least as restrictive as those in the appendix, then this is a Finding. UNCLASSIFIED 5-3
Page 1 and 2:
ACTIVE DIRECTORY SECURITY CHECKLIST
Page 3 and 4:
Active Directory Checklist, V1R1.2
Page 5 and 6:
Page 7 and 8:
Page 9 and 10:
Page 11 and 12:
Page 13 and 14:
Page 15 and 16:
Page 17 and 18:
Page 19 and 20:
Page 21 and 22: Active Directory Checklist, V1R1.2
Page 71: Active Directory Checklist, V1R1.2
Page 123 and 124:
Page 125 and 126:
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Page 133 and 134:
Page 135 and 136:
show all

ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?