Windows services that are critical for directory server operation must be configured for automatic startup.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
WN12-AD-000010-DC	WN12-AD-000010-DC	WN12-AD-000010-DC_rule		Medium

Description
Active Directory (AD) is dependent on several Windows services. If one or more of these services is not configured for automatic startup, AD functions may be partially or completely unavailable until the services are manually started. This could result in a failure to replicate data or to support client authentication and authorization requests.

STIG	Date
Microsoft Windows Server 2012 Domain Controller Security Technical Implementation Guide	2013-07-25

Details

Check Text ( C-WN12-AD-000010-DC_chk )
Run "services.msc" to display the Services console. Verify the Startup Type for the following Windows services: - Active Directory Domain Services - DFS Replication - DNS Client - DNS server - Group Policy Client - Intersite Messaging - Kerberos Key Distribution Center - NetLogon - Windows Time (not required if another time synchronization tool is implemented to start automatically) If the Startup Type for any of these services is not Automatic, this is a finding.

Check Text ( C-WN12-AD-000010-DC_chk )

Run "services.msc" to display the Services console.

Verify the Startup Type for the following Windows services:
- Active Directory Domain Services
- DFS Replication
- DNS Client
- DNS server
- Group Policy Client
- Intersite Messaging
- Kerberos Key Distribution Center
- NetLogon
- Windows Time (not required if another time synchronization tool is implemented to start automatically)

If the Startup Type for any of these services is not Automatic, this is a finding.

Fix Text (F-WN12-AD-000010-DC_fix)
Ensure the following services that are critical for directory server operation are configured for automatic startup. - Active Directory Domain Services - DFS Replication - DNS Client - DNS server - Group Policy Client - Intersite Messaging - Kerberos Key Distribution Center - NetLogon - Windows Time (not required if another time synchronization tool is implemented to start automatically)