The Windows Time Service on the forest root PDC Emulator must be configured to acquire its time from an external time source.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-8557	AD.0295	SV-9054r2_rule	ECTM-1 ECTM-2	Medium

Description
When the Windows Time service is used to synchronize time on client computers (workstations and servers) throughout an AD forest, the forest root domain PDC Emulator is the normal default to provide the authoritative time source for the entire forest. To obtain an accurate time for itself, the forest root domain PDC Emulator acts as a client to an external time source. If the Windows Time service on the forest root domain PDC Emulator is not configured to acquire the time from a proper source, it may cause time service clients throughout the forest to operate with the inaccurate time setting. When a Windows computer operates with an inaccurate time setting, access to resources on computers with the accurate time might be denied. This is notably true when Kerberos authentication is utilized. Operation with an inaccurate time setting can reduce the value of audit data and invalidate it as a source of forensic evidence in an incident investigation. Further Policy Details: The Windows Time service is the preferred time synchronization tool for Windows domain controllers. This check is Not Applicable for Component locations that do not have the AD forest root domain on site. This check must be performed on the domain controller in the forest root domain that holds the PDC Emulator FSMO role.

Description

When the Windows Time service is used to synchronize time on client computers (workstations and servers) throughout an AD forest, the forest root domain PDC Emulator is the normal default to provide the authoritative time source for the entire forest. To obtain an accurate time for itself, the forest root domain PDC Emulator acts as a client to an external time source. If the Windows Time service on the forest root domain PDC Emulator is not configured to acquire the time from a proper source, it may cause time service clients throughout the forest to operate with the inaccurate time setting. When a Windows computer operates with an inaccurate time setting, access to resources on computers with the accurate time might be denied. This is notably true when Kerberos authentication is utilized. Operation with an inaccurate time setting can reduce the value of audit data and invalidate it as a source of forensic evidence in an incident investigation. Further Policy Details: The Windows Time service is the preferred time synchronization tool for Windows domain controllers. This check is Not Applicable for Component locations that do not have the AD forest root domain on site. This check must be performed on the domain controller in the *forest root domain* that holds the PDC Emulator FSMO role.

STIG	Date
Active Directory Forest Security Technical Implementation Guide (STIG)	2016-12-19

Details

Check Text ( C-7714r1_chk )
1. Use Registry Editor to navigate to the following: HLM\System\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient 2. If the value for “Enabled” is not “1”, then this is a finding. 3. Use Registry Editor to navigate to the following: HKLM\System\CurrentControlSet\Services\W32Time\Parameters 4. If the value for “Type” is not “NTP”, then this is a finding. Note: If these checks indicate a finding because the NtpClient is not enabled, ask the SA to demonstrate that a) an alternate time synchronization tool is installed and enabled and that b) a DoD-authorized external time source is being used. 5. If the Windows Time service is not enabled or no alternate tool is installed and enabled in its place, then this is a finding.

Check Text ( C-7714r1_chk )

1. Use Registry Editor to navigate to the following: HLM\System\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient

2. If the value for “Enabled” is not “1”, then this is a finding.

3. Use Registry Editor to navigate to the following: HKLM\System\CurrentControlSet\Services\W32Time\Parameters

4. If the value for “Type” is not “NTP”, then this is a finding.

Note: If these checks indicate a finding because the NtpClient is not enabled, ask the SA to demonstrate that
a) an alternate time synchronization tool is installed and enabled and that
b) a DoD-authorized external time source is being used.

5. If the Windows Time service is not enabled or no alternate tool is installed and enabled in its place, then this is a finding.

Fix Text (F-8075r1_fix)
Configure the Windows Time service on the forest root PDC Emulator to acquire its time from an external time source.