Changes to the AD schema must be subject to a documented configuration management process.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-8527	DS00.0100_AD	SV-30998r3_rule	DCPR-1	Low

Description
Poorly planned or implemented changes to the AD schema could cause the applications that rely on AD (such as web and database servers) to operate incorrectly or not all. Improper changes to the schema could result in changes to AD objects that are incompatible with correct operation of the Windows domain controller and the domain clients. This could cause outages that prevent users from logging on or accessing Windows server resources across multiple hosts.

Description

Poorly planned or implemented changes to the AD schema could cause the applications that rely on AD (such as web and database servers) to operate incorrectly or not all. Improper changes to the schema could result in changes to AD objects that are incompatible with correct operation of the Windows domain controller and the domain clients. This could cause outages that prevent users from logging on or accessing Windows server resources across multiple hosts.

STIG	Date
Active Directory Forest Security Technical Implementation Guide (STIG)	2016-12-19

Details

Check Text ( C-7684r2_chk )
1. Interview the IAO. 2. Obtain a copy of the site’s configuration management procedures documentation. 3. Verify that there is a local policy that requires changes to the directory schema to be processed through a configuration management process. This applies to directory schema changes whether implemented in a database or other types of files. For AD, this refers to changes to the AD schema. 4. If there is no policy that requires changes to the directory schema to be processed through a configuration management process, then this is a finding.

Check Text ( C-7684r2_chk )

1. Interview the IAO.

2. Obtain a copy of the site’s configuration management procedures documentation.

3. Verify that there is a local policy that requires changes to the directory schema to be processed through a configuration management process. This applies to directory schema changes whether implemented in a database or other types of files. For AD, this refers to changes to the AD schema.

4. If there is no policy that requires changes to the directory schema to be processed through a configuration management process, then this is a finding.

Fix Text (F-8056r1_fix)
Document and implement a policy to ensure that changes to the AD schema are subject to a configuration management process.