ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
DS10.0280 Site Link Replication Properties
STIG ID \ V-Key DS10.0280 \ V0008553
Severity Cat III
Short Name Site Link Replication Properties
IA Controls ECAN-1, ECCD-1, ECCD-2
MAC /Conf 1-CS, 2-CS, 3-CSP
References AD STIG 2.3.3.7
Long Name: An AD site link is defined with schedule and replication interval properties that
prevent daily AD replication.
Checks:
• Start the Active Directory Sites and Services console (“Start”, “Run…”,
“dssite.msc”).
• Select and expand the Sites item in the left pane.
- Select and expand the Inter-Site Transports item and the IP item in the left pane
- For *each* site link that is defined:
-- Right-click the site link item and select the Properties item
-- Note the interval indicated in the “Replicate every” field
-- Select the Change Schedule button.
-- Using the values indicated for “Replication Available”, determine if the
replication interval would allow daily replication to occur. [See note below.]
-- Select the Cancel button for the Schedule window.
-- Select the Cancel button for the Properties window.
• If the replication interval and replication available properties do not allow daily
replication, then this is a Finding.
Note: An AD instance may have no AD site links defined.
Note: The following are ways in which site link properties would prevent daily AD
replication:
- Setting the “Replicate every” value to a number greater than 1440 (the number of
minutes in one day)
- Setting the Schedule value for all hours in a day to “Replication Not Available”.
UNCLASSIFIED
5-27