UCF STIG Viewer Logo

Windows 2003 Domain Controller Security Technical Implementation Guide


Overview

Date Finding Count (135)
2014-12-13 CAT I (High): 21 CAT II (Med): 86 CAT III (Low): 28
STIG Description
The Windows 2003 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements were developed from Federal and DoD consensus, as well as the Windows 2003 Security Guide and security templates published by Microsoft Corporation. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.letterkenny.FSO.mbx.stig-customer-support-mailbox@mail.mil.

Available Profiles



Findings (MAC III - Administrative Sensitive)

Finding ID Severity Title
V-1073 High Systems must be at supported service packs (SP) or releases levels.
V-34974 High The Windows Installer Always install with elevated privileges must be disabled.
V-6834 High Named Pipes and Shares can be accessed anonymously.
V-1159 High The Recovery Console option is set to permit automatic logon to the system.
V-1153 High The Send download LanMan compatible password option is not set to Send NTLMv2 response only\refuse LM.
V-1155 High The Deny access to this computer from the network user right on domain controllers must be configured to prevent unauthenticated access.
V-2374 High The system is configured to autoplay removable media.
V-1093 High Anonymous shares are not restricted.
V-1145 High Automatic logons must be disabled.
V-3338 High Unauthorized named pipes are accessible with anonymous credentials.
V-3339 High Unauthorized registry paths are remotely accessible.
V-18010 High Unapproved Users have access to Debug programs.
V-12780 High The Synchronize directory service data user right must be configured to include no accounts or groups (blank).
V-3343 High Solicited Remote Assistance is allowed.
V-3341 High Remote control of a Terminal Service session is allowed.
V-3340 High Unauthorized shares can be accessed anonymously.
V-3344 High The use of local accounts with blank passwords is not restricted to console logons only.
V-4443 High Unauthorized registry paths and sub-paths are remotely accessible.
V-1102 High Unauthorized users are granted right to Act as part of the operating system.
V-17900 High Disallow AutoPlay/Autorun from Autorun.inf
V-3379 High The system is configured to store the LAN Manager hash of the password in the SAM.
V-3384 Medium The system is not configured to make the object creator the owner of objects created by administrators.
V-3383 Medium The system is not configured to use FIPS compliant Algorithms for Encryption, Hashing, and Signing.
V-3381 Medium The system is not configured to recommended LDAP client signing requirements.
V-3380 Medium The system is not configured to force users to log off when their allowed logon hours expire.
V-39137 Medium The Enhanced Mitigation Experience Toolkit (EMET) V4.1 Update 1 or later must be installed on the system.
V-3460 Medium Terminal Services is not configured to disconnect clients when time limits are exceeded.
V-3469 Medium The system is configured to prevent background refresh of Group Policy.
V-15823 Medium Remove Software Certificate Installation Files
V-3375 Medium Domain Controller authentication is not required to unlock the workstation.
V-1164 Medium Outgoing secure channel traffic is not signed when possible.
V-1166 Medium The Windows SMB client is not enabled to perform SMB packet signing when possible.
V-1163 Medium Outgoing secure channel traffic is not encrypted when possible.
V-1162 Medium The Windows SMB server is not enabled to perform SMB packet signing when possible.
V-3471 Medium The system must be configured to collect error information.
V-3470 Medium The system is configured to allow unsolicited remote assistance offers.
V-3385 Medium The system is configured to allow case insensitivity.
V-1089 Medium The required legal notice must be configured to display before console logon.
V-3479 Medium The system is not configured to use Safe DLL Search Mode.
V-3478 Medium The system is configured to allow installation of printers using kernel-mode drivers.
V-1080 Medium File-auditing configuration does not meet minimum requirements.
V-36704 Medium The Enhanced Mitigation Experience Toolkit (EMET) Protection Profile for Popular Software must be implemented.
V-36705 Medium The Enhanced Mitigation Experience Toolkit (EMET) system-wide Data Execution Prevention (DEP) must be enabled and configured to at least Application Opt Out.
V-6850 Medium Auditing must be configured as required.
V-6836 Medium For systems utilizing a logon ID as the individual identifier, passwords must be a minimum of 14 characters in length.
V-6832 Medium The Windows Server SMB client is not enabled to always perform SMB packet signing.
V-6833 Medium The Windows Server SMB server is not enabled to always perform SMB packet signing.
V-6831 Medium Outgoing secure channel traffic is not encrypted or signed.
V-14262 Medium IPv6 must be disabled until a deliberate transition strategy has been implemented.
V-1154 Medium Ctrl+Alt+Del security attention sequence is Disabled.
V-1157 Medium The Smart Card removal option is set to take no action.
V-1099 Medium Lockout duration does not meet minimum requirements.
V-1098 Medium Time before bad-logon counter is reset does not meet minimum requirements.
V-2373 Medium The Server Operators group must have the ability to schedule jobs by means of the AT command disabled.
V-2372 Medium Reversible password encryption is not disabled.
V-2377 Medium The Kerberos service ticket maximum lifetime must meet minimum standards.
V-2376 Medium The Kerberos policy option must be configured to enforce user logon restrictions.
V-3349 Medium Windows Messenger (MSN Messenger, .NET messenger) is run at system startup.
V-1097 Medium Number of allowed bad-logon attempts does not meet minimum requirements.
V-3382 Medium The system is not configured to meet the minimum requirement for session security for NTLM SSP based Clients.
V-3372 Medium The system can be removed from the docking station without logging on first.
V-3376 Medium The system is configured to permit storage of credentials or .NET Passports.
V-3377 Medium The system is configured to give anonymous users Everyone rights.
V-3374 Medium The system is not configured to require a strong session key.
V-3378 Medium The system is not configured to use the Classic security model.
V-1171 Medium Ejection of removable NTFS media is not restricted to Administrators.
V-1141 Medium Unencrypted password is sent to 3rd party SMB Server.
V-3459 Medium Terminal Services is not configured to allow only the original client to reconnect.
V-3458 Medium Terminal Services idle session time limit does not meet the requirement.
V-3450 Medium Terminal Services is not configured to limit the number of connections.
V-3457 Medium Terminal Services is not configured to set a time limit for disconnected sessions.
V-3456 Medium Terminal Services is not configured to delete temporary folders.
V-3455 Medium Terminal Services is configured to use a common temporary folder for all sessions.
V-3454 Medium Terminal Services is not configured with the client connection encryption set to the required level.
V-4407 Medium Domain Controllers must require LDAP signing.
V-3369 Medium Restricted accounts are not disabled.
V-1139 Medium The option to prevent the password in dial-up networking from being saved is not enabled.
V-14247 Medium Terminal Services / Remote Desktop Service - Prevent password saving in the Remote Desktop Client
V-1114 Medium The built-in guest account has not been renamed.
V-1115 Medium The built-in administrator account has not been renamed.
V-3426 Medium The system is configured to allow remote desktop sharing through NetMeeting.
V-3480 Medium Media Player must be configured to prevent automatic checking for updates.
V-4107 Medium Windows operating systems that are no longer supported by the vendor for security updates must not be installed on a system.
V-1113 Medium The built-in guest account is not disabled.
V-32274 Medium The DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate must be installed.
V-32272 Medium The DoD Root Certificate must be installed.
V-3348 Medium The user is allowed to launch Windows Messenger (MSN Messenger, .NET Messenger).
V-3342 Medium The computer does not wait for the network at computer startup.
V-2380 Medium The Kerberos policy option Maximum tolerance for computer clock synchronization must be set to a maximum of 5 minutes or less.
V-1118 Medium Event log sizes do not meet minimum requirements.
V-4448 Medium Group Policy objects are not reprocessed if they have not changed.
V-4447 Medium The Terminal Server does not require secure RPC communication.
V-4446 Medium Software certificate restriction policies are not enforced.
V-3666 Medium The system is not configured to meet the minimum requirement for session security for NTLM SSP based Servers.
V-1103 Medium User rights assignments must meet minimum requirements.
V-1107 Medium Password uniqueness does not meet minimum requirements.
V-1105 Medium Minimum password age does not meet minimum requirements.
V-1104 Medium Maximum password age does not meet minimum requirements.
V-4444 Medium Users must enter a password to access private keys.
V-3449 Medium Terminal Services is not configured to limit users to one remote session.
V-26483 Medium The Deny log on as a batch job user right on domain controllers must be configured to prevent unauthenticated access.
V-26486 Medium The Deny log on through Terminal Services user right on domain controllers must prevent all access if TS is not used by the organization. If TS is used, it must be configured to prevent unauthenticated access.
V-26484 Medium The Deny log on as a service user right will be configured to include no one (blank).
V-26485 Medium The Deny log on locally user right on domain controllers must be configured to prevent unauthenticated access.
V-2379 Medium The Kerberos policy option Maximum lifetime for user ticket renewal must be configured for a maximum of 7 days or less.
V-2378 Medium The Kerberos policy option maximum lifetime for user ticket must be set to a maximum of 10 hours or less.
V-40237 Medium The US DoD CCEB Interoperability Root CA 1 to DoD Root CA 2 cross-certificate must be installed into the Untrusted Certificates Store.
V-1075 Low The system allows shutdown from the logon dialog box.
V-1174 Low Amount of idle time required before suspending a session is improperly set.
V-1173 Low The default permissions of Global system objects are not increased.
V-1165 Low The computer account password is prevented from being reset.
V-1160 Low The unsigned driver installation behavior is improperly set.
V-11806 Low The system is configured to allow the display of the last user name on the logon screen.
V-1158 Low The Recovery Console SET command is enabled.
V-1150 Low The built-in Microsoft password filter is not enabled.
V-1151 Low Print driver installation privilege is not restricted to administrators.
V-1091 Low System does not halt once an event log has reached its maximum size.
V-1090 Low Caching of logon credentials is not limited.
V-3373 Low The maximum age for machine account passwords is not set to requirements.
V-26359 Low The Windows dialog box title for the legal banner must be configured.
V-4408 Low The domain controller must be configured to allow reset of machine account passwords.
V-1136 Low Users must be forcibly disconnected when their logon hours expire.
V-1172 Low Users are not warned in advance that their passwords will expire.
V-4438 Low TCP data retransmissions are not controlled.
V-4437 Low TCP connection response retransmissions are not controlled.
V-4111 Low The system is configured to redirect ICMP.
V-4110 Low The system is configured to allow IP source routing.
V-4108 Low The system does not generate an audit event when the audit log reaches a percent full threshold.
V-4109 Low The system must be configured to disable dead gateway detection.
V-4113 Low The system is configured for a greater keep-alive time than recommended.
V-4112 Low The system is configured to detect and configure default gateway addresses.
V-4117 Low The system is configured to allow SYN attacks.
V-4116 Low The system is configured to allow name-release attacks.
V-4442 Low This check verifies that Windows is configured to have password protection take effect within a limited time frame when the screen saver becomes active.
V-4445 Low Optional Subsystems are permitted to operate on the system.