Selective Authentication must be enabled on outgoing forest trusts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-8540	AD.0200	SV-9037r3_rule	ECAN-1 ECCD-1 ECCD-2	Medium

Description
Enabling Selective Authentication on outbound Active Directory (AD) forest trusts significantly strengthens access control by requiring explicit authorization (through the Allowed to Authenticate permission) on resources in the trusting forest. When Selective Authentication is not enabled, less secure resource access permissions (such as those that specify Authenticated Users) might permit unauthorized access.

Description

Enabling Selective Authentication on outbound Active Directory (AD) forest trusts significantly strengthens access control by requiring explicit authorization (through the Allowed to Authenticate permission) on resources in the trusting forest. When Selective Authentication is not enabled, less secure resource access permissions (such as those that specify Authenticated Users) might permit unauthorized access.

STIG	Date
Active Directory Domain Security Technical Implementation Guide (STIG)	2016-02-19

Details

Check Text ( C-66407r2_chk )
Open "Active Directory Domains and Trusts". (Available from various menus or run "domain.msc".) Right click the domain name in the left pane and select "Properties". Select the "Trusts" tab. For each outgoing forest trust, right-click the trust item and select "Properties". Select the "Authentication" tab. If the "Selective Authentication" option is not selected on every outgoing forest trust, this is a finding.

Check Text ( C-66407r2_chk )

Open "Active Directory Domains and Trusts". (Available from various menus or run "domain.msc".)
Right click the domain name in the left pane and select "Properties".
Select the "Trusts" tab.
For each outgoing forest trust, right-click the trust item and select "Properties".
Select the "Authentication" tab.

If the "Selective Authentication" option is not selected on every outgoing forest trust, this is a finding.

Fix Text (F-71795r1_fix)
Enable Selective Authentication on outgoing forest trust. Open "Active Directory Domains and Trusts". (Available from various menus or run "domain.msc".) Right click the domain name in the left pane and select "Properties". Select the "Trusts" tab. For each outgoing forest trust, right-click the trust item and select "Properties". Select the "Authentication" tab. Select the "Selective Authentication" option. (It may be necessary to configure the "Allowed to Authenticate" permission on resources in the trusting domain.)

Fix Text (F-71795r1_fix)

Enable Selective Authentication on outgoing forest trust.
Open "Active Directory Domains and Trusts". (Available from various menus or run "domain.msc".)
Right click the domain name in the left pane and select "Properties".
Select the "Trusts" tab.
For each outgoing forest trust, right-click the trust item and select "Properties".
Select the "Authentication" tab.
Select the "Selective Authentication" option.
(It may be necessary to configure the "Allowed to Authenticate" permission on resources in the trusting domain.)