UCF STIG Viewer Logo

Locally written (non-vendor) code used in AD operations must comply with the requirements of the Application STIG.


Finding ID Version Rule ID IA Controls Severity
V-14789 DS00.6110_AD SV-16167r2_rule COSW-1 Medium
Unlike vendor programs that might be recovered by purchasing and\or downloading a replacement copy, the lack of a backup for locally written (non-vendor) code could result in the inability to recover from inadvertent or malicious deletion or simple hardware failure.
Active Directory Service 2008 Security Technical Implementation Guide (STIG) 2011-05-23


Check Text ( C-14084r2_chk )
1. Interview the application SA or site representative. Ask if the site uses locally written applications that are running on the domain controllers.

2. If the site indicates AD directory maintenance does not use non-vendor code, then this check is not applicable.

3. If AD directory maintenance does use non-vendor code, obtain a copy of the security review results or other documentation which indicates that the review was completed. A self-assessment using the Application STIG is acceptable.

4. If the non-vendor code has not been reviewed using the Application STIG since it was created or modified, then this is a finding.
Fix Text (F-14999r2_fix)
Perform a security review using the Application STIG.