ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
5.3.2 Trust Relationships
The checks in this section address the AD trust relationships that are manually created by
administrators. This includes external, forest, and realm trusts.
DS10.0100 Trust Relationship Documentation
STIG ID \ V-Key DS10.0100 \ V0008530
Severity Cat III
Short Name Trust Relationship Documentation
IA Controls DCID-1
MAC /Conf 1-CSP, 2-CSP, 3-CSP
References AD STIG 2.3.1.2
Long Name: Appropriate documentation is not maintained for each external, forest, and realm
AD trust relationship.
Checks:
• Start the Active Directory Domains and Trusts console (“Start”, “Run…”,
“domain.msc”).
• Select the left pane item that matches the name of the domain being reviewed.
- Right-click the domain name and select the Properties item.
- On the domain object Properties window, select the Trusts tab.
- For *each* outgoing and incoming external, forest, and realm trust, record the
name of the other party (domain name), the trust type, transitivity, and the trust
direction.
[Retain this trust information for use in subsequent checks.]
• Compare the list of actual trusts with the local documentation maintained by the
IAO. [See note below.] For each trust the documentation must contain type
(external, forest, or realm), name of the other party, MAC and classification level
of the other party, trust direction (incoming and\or outgoing), transitivity, status of
the Selective Authentication option, and status of the SID filtering option.
• If an actual trust is not listed in the documentation or if any of the required items
are not documented, then this is a Finding.
Note: Checklist Appendix B contains samples of trust relationship documentation.
While these specific formats are not required, it is highly recommended that all of the
information on these samples be represented in the documentation maintained by the
IAO.
UNCLASSIFIED
5-16