Update access to the directory schema must be restricted to appropriate accounts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-15372	DS00.3140_AD	SV-30999r3_rule	ECAN-1 ECCD-1 ECCD-2	High

Description
A failure to control update access to the AD Schema object could result in the creation of invalid directory objects and attributes. Applications that rely on AD could fail as a result of invalid formats and values. The presence of invalid directory objects and attributes could cause failures in Windows AD client functions and improper resource access decisions.

STIG	Date
Active Directory Forest Security Technical Implementation Guide (STIG)	2014-12-18

Details

Check Text ( C-48678r2_chk )
Start a Schema management console. (See supplemental notes.) Select, then right-click on the Active Directory Schema entry in the left pane. Select Permissions. If any of the permissions for the Schema object are not at least as restrictive as those below, this is a finding. The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the Advanced button, selecting the desired entry, and the Edit button. These permissions are based on Windows 2008 and later. Variances for Windows 2003 are noted where applicable. Authenticated Users: Read Special Permissions The Special permissions for Authenticated Users are List and Read type. If detailed permissions include any additional Permissions or Properties this is a finding. System: Full Control Enterprise Read-only Domain Controllers: (NA on Windows 2003) Replicating Directory Changes Replicating Directory Changes All Replicating Directory Changes In Filtered Set Schema Admins: Read Write Create all child objects Change schema master Manage replication topology Monitor active directory replication Read only replication secret synchronization (NA on Windows 2003) Reanimate tombstones Replicating Directory Changes (Replicate Directory Changes on Windows 2003) Replicating Directory Changes All Replicating Directory Changes In Filtered Set (NA on Windows 2003) Replication synchronization Update schema cache Special permissions Administrators: Manage replication topology Replicating Directory Changes (Replicate Directory Changes on Windows 2003) Replicating Directory Changes All Replicating Directory Changes In Filtered Set (NA on Windows 2003) Replication Synchronization Enterprise Domain Controllers: Manage replication topology Replicating Directory Changes (Replicate Directory Changes on Windows 2003) Replicating Directory Changes All Replicating Directory Changes In Filtered Set (NA on Windows 2003) Replication Synchronization Supplemental Notes: If the Schema management console has not already been configured on the computer, create a console by using the following: The steps for adding the snap-in may vary depending on the Windows version. Register the required DLL module by typing the following at a command line "regsvr32 schmmgmt.dll". Run "mmc.exe" to start a Microsoft Management Console. Select Add/Remove Snap-in from the File menu. From the Available Standalone Snap-ins list, select Active Directory Schema Select the Add button. Select the OK button. When done using the console, select Exit from the File (or Console) menu. Select the No button to the Save console settings… prompt (unless the SA wishes to retain this console). If the console is retained, the recommended name is schmmgmt.msc and the recommended location is the [systemroot]\system32 directory.

Check Text ( C-48678r2_chk )

Start a Schema management console. (See supplemental notes.)
Select, then right-click on the Active Directory Schema entry in the left pane.
Select Permissions.

If any of the permissions for the Schema object are not at least as restrictive as those below, this is a finding.

The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the Advanced button, selecting the desired entry, and the Edit button.

These permissions are based on Windows 2008 and later. Variances for Windows 2003 are noted where applicable.

Authenticated Users:
Read
Special Permissions
The Special permissions for Authenticated Users are List and Read type. If detailed permissions include any additional Permissions or Properties this is a finding.

System:
Full Control

Enterprise Read-only Domain Controllers: (NA on Windows 2003)
Replicating Directory Changes
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set

Schema Admins:
Read
Write
Create all child objects
Change schema master
Manage replication topology
Monitor active directory replication
Read only replication secret synchronization (NA on Windows 2003)
Reanimate tombstones
Replicating Directory Changes (Replicate Directory Changes on Windows 2003)
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set (NA on Windows 2003)
Replication synchronization
Update schema cache
Special permissions

Administrators:
Manage replication topology
Replicating Directory Changes (Replicate Directory Changes on Windows 2003)
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set (NA on Windows 2003)
Replication Synchronization

Enterprise Domain Controllers:
Manage replication topology
Replicating Directory Changes (Replicate Directory Changes on Windows 2003)
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set (NA on Windows 2003)
Replication Synchronization

Supplemental Notes:
If the Schema management console has not already been configured on the computer, create a console by using the following:

The steps for adding the snap-in may vary depending on the Windows version.
Register the required DLL module by typing the following at a command line "regsvr32 schmmgmt.dll".
Run "mmc.exe" to start a Microsoft Management Console.
Select Add/Remove Snap-in from the File menu.
From the Available Standalone Snap-ins list, select Active Directory Schema
Select the Add button.
Select the OK button.

When done using the console, select Exit from the File (or Console) menu.
Select the No button to the Save console settings… prompt (unless the SA wishes to retain this console). If the console is retained, the recommended name is schmmgmt.msc and the recommended location is the [systemroot]\system32 directory.

Fix Text (F-47801r1_fix)
Ensure the access control permissions for the AD Schema object conform to the required permissions as shown below. Authenticated Users: Read Special Permissions The Special permissions for Authenticated Users are List and Read type. If detailed permissions include any additional Permissions or Properties this is a finding. System: Full Control Enterprise Read-only Domain Controllers: (NA on Windows 2003) Replicating Directory Changes Replicating Directory Changes All Replicating Directory Changes In Filtered Set Schema Admins: Read Write Create all child objects Change schema master Manage replication topology Monitor active directory replication Read only replication secret synchronization (NA on Windows 2003) Reanimate tombstones Replicating Directory Changes (Replicate Directory Changes on Windows 2003) Replicating Directory Changes All Replicating Directory Changes In Filtered Set (NA on Windows 2003) Replication synchronization Update schema cache Special permissions Administrators: Manage replication topology Replicating Directory Changes (Replicate Directory Changes on Windows 2003) Replicating Directory Changes All Replicating Directory Changes In Filtered Set (NA on Windows 2003) Replication Synchronization Enterprise Domain Controllers: Manage replication topology Replicating Directory Changes (Replicate Directory Changes on Windows 2003) Replicating Directory Changes All Replicating Directory Changes In Filtered Set (NA on Windows 2003) Replication Synchronization

Fix Text (F-47801r1_fix)

Ensure the access control permissions for the AD Schema object conform to the required permissions as shown below.

Authenticated Users:
Read
Special Permissions
The Special permissions for Authenticated Users are List and Read type. If detailed permissions include any additional Permissions or Properties this is a finding.

System:
Full Control

Enterprise Read-only Domain Controllers: (NA on Windows 2003)
Replicating Directory Changes
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set

Schema Admins:
Read
Write
Create all child objects
Change schema master
Manage replication topology
Monitor active directory replication
Read only replication secret synchronization (NA on Windows 2003)
Reanimate tombstones
Replicating Directory Changes (Replicate Directory Changes on Windows 2003)
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set (NA on Windows 2003)
Replication synchronization
Update schema cache
Special permissions

Administrators:
Manage replication topology
Replicating Directory Changes (Replicate Directory Changes on Windows 2003)
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set (NA on Windows 2003)
Replication Synchronization

Enterprise Domain Controllers:
Manage replication topology
Replicating Directory Changes (Replicate Directory Changes on Windows 2003)
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set (NA on Windows 2003)
Replication Synchronization