ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
DS10.0200 Selective Authentication Trust Option [Windows Server 2003 DC required]
STIG ID \ V-Key DS10.0200 \ V0008540
Severity Cat II
Short Name Selective Authentication Trust Option
IA Controls ECAN-1, ECCD-1, ECCD-2
MAC /Conf 1-CS, 2-CS, 3-CSP
References AD STIG 2.3.3.2
Long Name: An outgoing forest trust is configured without Selective Authentication.
Checks:
Note: This check is performed only on a domain with domain controller(s) running
Windows Server 2003. For domains with only Windows 2000 Server domain
controllers, this check will be Not Applicable.
• Start the Active Directory Domains and Trusts console (“Start”, “Run…”,
“domain.msc”).
• Select the left pane item that matches the name of the domain being reviewed.
- Right-click the domain name and select the Properties item.
- On the domain object Properties window, select the Trusts tab.
- For *each* outgoing forest trust:
-- Right-click the trust item and select the Properties item
-- On the trust Properties window, select the Authentication tab.
-- Determine if the Selective Authentication option is selected.
• If the Selective Authentication option is not selected on every outgoing forest
trust, then this is a Finding.
UNCLASSIFIED
5-20