ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
DS00.0140 Directory Data Object Auditing
STIG ID \ V-Key DS00.0140 \ V0008529
Severity Cat II
Short Name Directory Data Object Auditing
IA Controls ECAR-1, ECAR-2, ECAR-3
MAC /Conf 1-CSP, 2-CSP, 3-CSP
References AD STIG 2.3.3.5
Long Name: Directory service data objects do not have proper audit settings. For AD this
includes Group Policy Objects and other AD domain partition objects.
Checks:
A. Group Policy Object Procedures - Site Policies
• Start the Active Directory Sites and Services console (“Start”, “Run…”,
“dssite.msc”).
• Select and expand the Sites item in the left pane.
For *each* AD site that is defined (building icon):
- Right-click the site and select the Properties item.
- On the site Properties window, select the Group Policy tab.
- For *each* Group Policy Object Link:
-- Select the Group Policy Object Link item
-- Select the Properties button.
-- On the site Group Policy Properties window, select the Security tab.
-- Select the Advanced button and then the Auditing tab.
-- Compare the audit settings of the site Group Policy to the specifications for
Group Policy Objects in Checklist appendix A.4.
• If the actual audit settings for any site Group Policy object are not at least as
inclusive as those in the appendix, then this is a Finding.
B. Group Policy Object Procedures - Default Domain & OU Policies
• Start the Active Directory Users and Computers console (“Start”, “Run…”,
“dsa.msc”).
• Select the left pane item that matches the name of the domain being reviewed.
- Right-click the domain name and select the Properties item.
- On the domain Properties window, select the Group Policy tab and then the
Properties button.
- On the Default Domain Policy Properties window, select the Security tab.
- Select the Advanced button and then the Auditing tab.
- Compare the audit settings of the Default Domain Group Policy to the
specifications for Group Policy Objects in Checklist appendix A.4.
• If the actual audit settings for the Default Domain Policy Group Policy object are
not at least as inclusive as those in the appendix, then this is a Finding.
UNCLASSIFIED
5-12