Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-12780 | DS00.0210_2003 | SV-54939r1_rule | ECAN-1 ECCD-1 ECCD-2 ECLP-1 | High |
Description |
---|
A Windows account with the "Synchronize directory service data" right has the ability to read all information in the AD database. This bypasses the object access permissions that would otherwise restrict access to the data. The scope of access granted by this right is too broad for secure usage. Specific object permissions or other group membership assignments could be used to provide access on an appropriate scale. |
STIG | Date |
---|---|
Windows 2003 Domain Controller Security Technical Implementation Guide | 2014-04-07 |
Check Text ( None ) |
---|
None |
Fix Text (F-47821r2_fix) |
---|
Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Synchronize directory service data" to be defined but containing no entries (blank). |