Install or enable time synchronization on the directory service server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-8322	DS00.0150_AD	SV-31548r1_rule	ECTM-1 ECTM-2	Medium

Description
- When a directory service that uses multi-master replication (such as AD) executes on computers that do not have synchronized time, directory data may be corrupted or updated invalidly. - The lack of synchronized time could lead to audit log data that is misleading, inconclusive, or unusable. In cases of intrusion this may invalidate the audit data as a source of forensic evidence in an incident investigation. - In AD, the lack of synchronized time could prevent clients from logging on or accessing server resources as a result of Kerberos requirements related to time variance.

Description

- When a directory service that uses multi-master replication (such as AD) executes on computers that do not have synchronized time, directory data may be corrupted or updated invalidly. - The lack of synchronized time could lead to audit log data that is misleading, inconclusive, or unusable. In cases of intrusion this may invalidate the audit data as a source of forensic evidence in an incident investigation. - In AD, the lack of synchronized time could prevent clients from logging on or accessing server resources as a result of Kerberos requirements related to time variance.

STIG	Date
Active Directory Service 2008 Security Technical Implementation Guide (STIG)	2011-05-23

Details

Check Text ( C-7641r4_chk )
1. With the assistance of the SA or application SA, determine if a time synchronization tool has been implemented on the Windows domain controller. 2. If these Windows checks indicate a finding because the NtpClient is not enabled, ask the SA to demonstrate that an alternate time synchronization tool is installed and enabled. 3. If the Windows Time Service is not enabled and no alternate tool is enabled, then this is a finding. Check procedures for Windows Time Service: If the Windows Time Service is used, the following procedures apply. 1. Use Registry Editor to navigate to HKLM\System\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient. 2. If the value for “Enabled” is not “1”, then this is a finding. 3. Use Registry Editor to navigate to HKLM\System\CurrentControlSet\Services\W32Time\Parameters. 4. If the value for “Type” is not “NT5DS” (preferred), “NTP” or “AllSync”, then this is a finding.

Check Text ( C-7641r4_chk )

1. With the assistance of the SA or application SA, determine if a time synchronization tool has been implemented on the Windows domain controller.

2. If these Windows checks indicate a finding because the NtpClient is not enabled, ask the SA to demonstrate that an alternate time synchronization tool is installed and enabled.

3. If the Windows Time Service is not enabled and no alternate tool is enabled, then this is a finding.

Check procedures for Windows Time Service:
If the Windows Time Service is used, the following procedures apply.

1. Use Registry Editor to navigate to HKLM\System\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient.

2. If the value for “Enabled” is not “1”, then this is a finding.

3. Use Registry Editor to navigate to HKLM\System\CurrentControlSet\Services\W32Time\Parameters.

4. If the value for “Type” is not “NT5DS” (preferred), “NTP” or “AllSync”, then this is a finding.