The Synchronize directory service data user right must be configured to include no accounts or groups (blank).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-12780	DS00.0210_2008	SV-54938r1_rule		High

Description
A Windows account with the "Synchronize directory service data" right has the ability to read all information in the AD database. This bypasses the object access permissions that would otherwise restrict access to the data. The scope of access granted by this right is too broad for secure usage. Specific object permissions or other group membership assignments could be used to provide access on an appropriate scale.

Description

A Windows account with the "Synchronize directory service data" right has the ability to read all information in the AD database. This bypasses the object access permissions that would otherwise restrict access to the data. The scope of access granted by this right is too broad for secure usage. Specific object permissions or other group membership assignments could be used to provide access on an appropriate scale.

STIG	Date
Windows 2008 Domain Controller Security Technical Implementation Guide	2017-03-02

Details

Check Text ( C-48699r2_chk )
Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment. If any accounts or groups are granted the "Synchronize directory service data" user right, this is a finding.

Fix Text (F-47820r2_fix)
Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> "Synchronize directory service data" to be defined but containing no entries (blank).