Time synchronization must be installed and enabled on the directory service server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-8322	DS00.0150_2008_R2	SV-38999r1_rule	ECTM-1 ECTM-2	Medium

Description
When a directory service using multi-master replication (such as AD) executes on computers that do not have synchronized time, directory data may be corrupted or updated invalidly. - The lack of synchronized time could lead to audit log data that is misleading, inconclusive, or unusable. In cases of intrusion this may invalidate the audit data as a source of forensic evidence in an incident investigation. - In AD, the lack of synchronized time could prevent clients from logging on or accessing server resources as a result of Kerberos requirements related to time variance.

Description

When a directory service using multi-master replication (such as AD) executes on computers that do not have synchronized time, directory data may be corrupted or updated invalidly. - The lack of synchronized time could lead to audit log data that is misleading, inconclusive, or unusable. In cases of intrusion this may invalidate the audit data as a source of forensic evidence in an incident investigation. - In AD, the lack of synchronized time could prevent clients from logging on or accessing server resources as a result of Kerberos requirements related to time variance.

STIG	Date
Windows Server 2008 R2 Domain Controller Security Technical Implementation Guide	2012-09-05

Details

Check Text ( C-37988r1_chk )
1. With the assistance of the SA or application SA, determine if a time synchronization tool has been implemented on the Windows domain controller. 2. If these Windows checks indicate a finding because the NtpClient is not enabled, ask the SA to demonstrate an alternate time synchronization tool is installed and enabled. 3. If the Windows Time Service is not enabled and no alternate tool is enabled, then this is a finding. Check procedures for Windows Time Service: If the Windows Time Service is used, the following procedures apply. 1. Use Registry Editor to navigate to HKLM\System\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient. 2. If the value for “Enabled” is not “1”, then this is a finding. 3. Use Registry Editor to navigate to HKLM\System\CurrentControlSet\Services\W32Time\Parameters. 4. If the value for “Type” is not “NT5DS” (preferred), “NTP” or “AllSync”, then this is a finding.

Check Text ( C-37988r1_chk )

1. With the assistance of the SA or application SA, determine if a time synchronization tool has been implemented on the Windows domain controller.

2. If these Windows checks indicate a finding because the NtpClient is not enabled, ask the SA to demonstrate an alternate time synchronization tool is installed and enabled.

3. If the Windows Time Service is not enabled and no alternate tool is enabled, then this is a finding.

Check procedures for Windows Time Service:
If the Windows Time Service is used, the following procedures apply.

1. Use Registry Editor to navigate to HKLM\System\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient.

2. If the value for “Enabled” is not “1”, then this is a finding.

3. Use Registry Editor to navigate to HKLM\System\CurrentControlSet\Services\W32Time\Parameters.

4. If the value for “Type” is not “NT5DS” (preferred), “NTP” or “AllSync”, then this is a finding.

Fix Text (F-33230r1_fix)
Install and enable time synchronization on the directory service server.