Separate domain accounts must be used to manage public facing servers from any domain accounts used to manage internal servers.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-43652	AD.0013	SV-56473r1_rule	IAIA-1	Medium

Description
Public facing servers should be in DMZs with separate Active Directory forests. If, because of operational necessity, this is not possible, lateral movement from these servers must be mitigated within the forest. Having different domain accounts for administering domain joined public facing servers, from domain accounts used on internal servers, protects against an attacker’s lateral movement from a compromised public facing server.

Description

Public facing servers should be in DMZs with separate Active Directory forests. If, because of operational necessity, this is not possible, lateral movement from these servers must be mitigated within the forest. Having different domain accounts for administering domain joined public facing servers, from domain accounts used on internal servers, protects against an attacker’s lateral movement from a compromised public facing server.

STIG	Date
Active Directory Domain Security Technical Implementation Guide (STIG)	2014-04-01

Details

Check Text ( C-49398r4_chk )
If the domain does not have any public facing servers, this is NA. Review the local Administrators group on public facing servers. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group. For public facing servers, the Domain Admins group must be replaced by a domain member server administrator group whose members are different from any used to manage internal servers. If any domain accounts or groups used to manage internal servers are members of the local administrators group, this is a finding.

Check Text ( C-49398r4_chk )

If the domain does not have any public facing servers, this is NA.

Review the local Administrators group on public facing servers. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group.

For public facing servers, the Domain Admins group must be replaced by a domain member server administrator group whose members are different from any used to manage internal servers.

If any domain accounts or groups used to manage internal servers are members of the local administrators group, this is a finding.

Fix Text (F-49252r2_fix)
If the domain does not have any public facing servers, this is NA. Configure the system to include only administrator groups or accounts that are responsible for the system in the local Administrators group. For public facing servers, replace the Domain Admins group with a domain member server administrator group whose members are different from any used to manage internal servers.