ACTIVE DIRECTORY SECURITY CHECKLIST ... - Leet Upload

Active Directory Checklist, V1R1.2 Field Security Operations
22 September 2006 Defense Information Systems Agency
5.4 Active Directory Forest
Notes: The checks in this section apply to Active Directory Forest assets and are performed on
only one or two domain controllers per AD forest according to forest configuration as
follows:
- DS10.0230 applies only for Windows Server 2003 and must be done on that platform.
- DS10.0295 applies only to the domain controller that holds the authoritative time source
for the forest. When the Windows Time service is used, that is the root domain
controller that holds the PDC Emulator FSMO role.
The checks in this section address some forest-specific characteristics that affect the level of
security within an AD forest.
DS10.0230 dsHeuristics Option [Windows Server 2003 only]
STIG ID \ V-Key DS10.0230 \ V0008555
Severity Cat II
Short Name dsHeuristics Option
IA Controls ECAN-1, ECCD-1, ECCD-2
MAC /Conf 1-CS, 2-CS, 3-CSP
References AD STIG 2.3.3.4
Long Name: The dsHeuristics option is not configured to prevent anonymous access to AD.
Checks:
Note: This check is Not Applicable for domains that contain no Windows Server
2003 domain controllers.
This check must be performed on a Windows Server 2003 domain controller.
• At a command line prompt enter (on a single line):
“dsquery * "cn=directory service,cn=windows nt,cn=services,
cn=configuration,dc=forest-name" -attr *”
where forest-name is the fully qualified LDAP name of the
root of the domain being reviewed.
• If the dsHeuristics attribute is listed, note the assigned value.
• If the dsHeuristics attribute is defined and has a “2” in the seventh character, then
this is a Finding.
Note: An example of the dsquery command for the vcfn.disaost.mil forest is:
dsquery * "cn=directory service,cn=windows nt,cn=services,
cn=configuration,dc=vcfn,dc=disaost,dc=mil" -attr *
Note: Examples of values that would be a Finding are: “0000002”, “0010002”,
“0000002000001”.
UNCLASSIFIED
5-29