Unlike vendor programs that might be recovered by purchasing and\or downloading a replacement copy, the lack of a backup for locally written (non-vendor) code could result in the inability to recover from inadvertent or malicious deletion or simple hardware failure.
1. Interview the application SA or site representative. Ask if the site uses locally written applications that are running on the domain controllers.
2. If the site indicates AD directory maintenance does not use non-vendor code, then this check is not applicable.
3. If AD directory maintenance does use non-vendor code, obtain a copy of the security review results or other documentation which indicates that the review was completed. A self-assessment using the Application STIG is acceptable.
4. If the non-vendor code has not been reviewed using the Application STIG since it was created or modified, then this is a finding.
Fix Text (F-14999r2_fix)
Perform a security review using the Application STIG.