ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
Note: An AD instance may have no AD site Group Policies defined.
B. Group Policy Object Procedures - Default Domain & OU Policies
• Start the Active Directory Users and Computers console (“Start”, “Run…”,
“dsa.msc”). Ensure that the Advanced Features item on the View menu is
enabled.
• Select the left pane item that matches the name of the domain being reviewed.
- Right-click the domain name and select the Properties item.
- On the domain Properties window, select the Group Policy tab and then the
Properties button.
- On the Default Domain Policy Properties window, select the Security tab.
- Compare the ACL of the Default Domain Group Policy to the specifications for
Group Policy Objects in Checklist appendix A.3.
• If the actual permissions for the Default Domain Policy Group Policy object are
not at least as restrictive as those in the appendix, then this is a Finding.
• Return to the initial console view.
• For each OU that is defined (folder in folder icon):
- Right-click the OU and select the Properties item.
- On the OU Properties window, select the Group Policy tab.
- For *each* Group Policy Object Link:
-- Select the Group Policy Object Link item
-- Select the Properties button.
-- On the OU Group Policy Properties window, select the Security tab.
-- Compare the ACL of the OU Group Policy to the specifications for Group
Policy Objects in Checklist appendix A.3.
• If the actual permissions for any OU Group Policy object are not at least as
restrictive as those in the appendix, then this is a Finding.
Note: Each domain has at least one OU that has a Group Policy. This will be the
Domain Controllers OU.
C. Organizational Unit Object Procedures
• Start the Active Directory Users and Computers console (“Start”, “Run…”,
“dsa.msc”). Ensure that the Advanced Features item on the View menu is
enabled.
• For each OU that is defined (folder in folder icon):
- Right-click the OU and select the Properties item.
- On the OU Properties window, select the Security tab.
- Compare the ACL of the OU to the specifications for Organizational Unit
Objects in Checklist appendix A.3.
• If the actual permissions for any OU object are not at least as restrictive as those
in the appendix, then this is a Finding.
This check includes the functions of Windows Checklist item 2.013. That check will be removed
in future versions of the Windows Checklists.
UNCLASSIFIED
5-11