ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
5.3 Active Directory Domain
Notes: The checks in this section apply to Active Directory Domain assets and are performed on
only one domain controller per AD domain.
Some of these checks apply only to Windows Server 2003 and must be done on that
platform.
These checks examine characteristics that apply to an entire Windows domain. Because AD data
is replicated among its domain controllers, performing these checks on a single (up-to-date)
domain controller is sufficient.
5.3.1 AD Object Access Permissions and Auditing
The checks in this section address access control and auditing for selected AD objects in the AD
database. Access permissions are examined for AD objects including Group Policy Objects and
Organizational Units. Auditing is examined for AD objects including Group Policy Objects,
Organizational Units, and several other AD domain partition objects.
DS00.0130 Directory Data Object Access Control
STIG ID \ V-Key DS00.0130 \ V0008528
Severity Cat I
Short Name Directory Data Object Access Control
IA Controls ECAN-1, ECCD-1, ECCD-2, ECLP-1
MAC /Conf 1-CSP, 2-CSP, 3-CSP
References AD STIG 2.3.3.4
Long Name: Directory service data objects do not have proper access permissions (ACLs). For
AD this includes Group Policy Objects and Organizational Units (OUs).
Checks:
A. Group Policy Object Procedures - Site Policies
• Start the Active Directory Sites and Services console (“Start”, “Run…”,
“dssite.msc”).
• Select and expand the Sites item in the left pane.
For each AD site that is defined (building icon):
- Right-click the AD site and select the Properties item.
- On the site Properties window, select the Group Policy tab.
- For *each* Group Policy Object Link:
-- Select the Group Policy Object Link item
-- Select the Properties button.
-- On the site Group Policy Properties window, select the Security tab.
-- Compare the ACL of the site Group Policy to the specifications for Group
Policy Objects in Checklist appendix A.3.
• If the actual permissions for any AD site object are not at least as restrictive as
those in the appendix, then this is a Finding.
UNCLASSIFIED
5-10