ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
DS10.0250 Privileged Group Membership - Inter-Forest
STIG ID \ V-Key DS10.0250 \ V0008549
Severity Cat II
Short Name Privileged Group Membership - Inter-Forest
IA Controls ECLP-1, ECPA-1
MAC /Conf 1-CSP, 2-CSP, 3-CSP
References AD STIG 2.3.3.6
Long Name: Accounts from another AD forest are members of Windows built-in
administrative groups and the other forest is not under the control of the same
organization or subject to the same security policies.
Checks:
• Start the Active Directory Users and Computers console (“Start”, “Run…”,
“dsa.msc”).
• Select and expand the left pane item that matches the name of the domain being
reviewed.
• Select the Users container
- For each of the Domain Admins, Enterprise Admins, Schema Admins, and
Group Policy Creator Owners groups:
-- Double-click on the group and select the Members tab
-- Examine the defined accounts to see if they are from a domain that is not in the
forest being reviewed.
• Select the Builtin container
- If the Incoming Forest Trust Builders group is defined:
-- Double-click on the group and select the Members tab
-- Examine the defined accounts to see if they are from a domain that is not in the
forest being reviewed.
• If any account in an administrative group is from a domain outside the forest
being reviewed and that outside forest is not maintained by the same organization
(e.g., enclave) or subject to the same security policies, then this is a Finding.
Note: An account that is from an outside domain appears in the format “outsidedomain-NetBIOSname\account”
or “account@outside-domain-fully-qualifiedname”.
Examples are “AOFN21\jsmith” or “jsmith@AOFN21.DISA.MIL”. It may
be necessary to use the AD Domains and Trusts (domain.msc) console to determine
if the domain is from another AD forest.
Note: It is possible to move the highly privileged AD security groups out of the AD
Users container. If the Domain Admins, Enterprise Admins, Schema Admins, or
Group Policy Creator Owners groups are not in the AD User container, ask the SA
for the new location and use that location for this check.
UNCLASSIFIED
5-23