UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The Synchronize directory service data user right must be configured to include no accounts or groups (blank).


Overview

Finding ID Version Rule ID IA Controls Severity
V-12780 DS00.0210_2003 SV-54939r1_rule ECAN-1 ECCD-1 ECCD-2 ECLP-1 High
Description
A Windows account with the "Synchronize directory service data" right has the ability to read all information in the AD database. This bypasses the object access permissions that would otherwise restrict access to the data. The scope of access granted by this right is too broad for secure usage. Specific object permissions or other group membership assignments could be used to provide access on an appropriate scale.
STIG Date
Windows 2003 Domain Controller Security Technical Implementation Guide 2014-04-07

Details

Check Text ( None )
None
Fix Text (F-47821r2_fix)
Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Synchronize directory service data" to be defined but containing no entries (blank).