ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
E. AdminSDHolder Object Procedures
• Start the Active Directory Users and Computers console (“Start”, “Run…”,
“dsa.msc”). Ensure that the Advanced Features item on the View menu is
enabled.
• Select and expand the left pane item that matches the name of the domain being
reviewed.
- Select the System object.
- Right-click the AdminSDHolder object and select the Properties item.
- On the AdminSDHolder object Properties window, select the Security tab.
- Select the Advanced button and then the Auditing tab.
- Compare the audit settings of the AdminSDHolder object to the specifications
for AdminSDHolder Objects in Checklist appendix A.4.
• If the actual audit settings are not at least as inclusive as those in the appendix,
then this is a Finding.
F. RID Manager$ Object Procedures
• Start the Active Directory Users and Computers console (“Start”, “Run…”,
“dsa.msc”). Ensure that the Advanced Features item on the View menu is
enabled.
• Select and expand the left pane item that matches the name of the domain being
reviewed.
- Select the System object.
- Right-click the RID Manager$ object and select the Properties item.
- On the RID Manager$ object Properties window, select the Security tab.
- Select the Advanced button and then the Auditing tab.
- Compare the audit settings of the RID Manager$ object to the specifications for
RID Manager$ Objects in Checklist appendix A.4.
• If the actual audit settings are not at least as inclusive as those in the appendix,
then this is a Finding.
G. Domain Controllers OU Object Procedures
• Start the Active Directory Users and Computers console (“Start”, “Run…”,
“dsa.msc”).
• Right-click the Domain Controllers OU and select the Properties item.
- On the OU Properties window, select the Security tab.
- Select the Advanced button and then the Auditing tab.
- Compare the audit settings of the OU to the specifications for Domain
Controllers OU Objects in Checklist appendix A.4.
• If the actual audit settings for the Domain Controllers OU object are not at least as
inclusive as those in the appendix, then this is a Finding.
This check includes the functions of Windows Checklist item 2.021. That check will be removed
in future versions of the Windows Checklists.
UNCLASSIFIED
5-14