ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
Section 2 Review Results Report
This section is a template that allows a reviewer to manually document
details about the object of the review and the vulnerabilities found during
the review process. Information about the items listed is obtained through
the procedures documented in Sections 3 and 5.
Section 3 System Administrator /Information Assurance Officer Interview Questions
This section documents the questions that a reviewer discusses with the
System Administrator (SA) or Information Assurance Officer (IAO)
during the review process. The items reviewed correspond to a subset of
those listed in Section 2.
Section 4 Automated Check Procedures
This section is reserved for the procedures to be developed at a later time
to perform a review using automated procedures.
Section 5 Manual Check Procedures
This section documents the procedures to be used to perform a review
manually. The items reviewed correspond to a subset of those listed in
Section 2.
Appendix A Object Permissions and Audit Settings
This appendix documents any required Access Control Lists (ACLs) and
audit settings for file, registry, and AD objects. The tables in this appendix
are referenced in Section 5.
Appendix B Documentation
This appendix consists of two parts. The first part provides guidance on
gathering information before the review trip. The second part provides
examples of documentation used to satisfy some requirements. The
examples in this appendix are referenced in Section 5.
Appendix C VMS Process Guidance
This appendix provides guidance for entering and accessing the asset
information in VMS for the items covered by the Checklist.
Appendix D Directory Information Gathering
This appendix describes tools and methods that could be used to gather
directory information.
1.3 Supported Versions
This document describes processes to review an AD environment composed of Windows 2000
Server or Windows Server 2003 domain controllers.
UNCLASSIFIED
1-2