Active Directory Forest Security Technical Implementation Guide

Quick Actions

We are continuing to improve Stigviewer and we are planning on rolling out new services in the near future. Would you like to be part of the conversation on what those features should be? If so, click here.

Featured Partners

Web page built by Cyber Protection Services

Check out our new AI-powered GRC tool here .
Compliance Dictionary

Standardizes and unifies compliance terms.

Overview

Version	Date	Finding Count (7)			Downloads
3	2024-09-13	CAT I (High): 3	CAT II (Medium): 3	CAT III (Low): 1	Excel JSON XML

Stig Description

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Classified	Public	Sensitive
I - Mission Critical Classified	I - Mission Critical Public	I - Mission Critical Sensitive	II - Mission Critical Classified	II - Mission Critical Public	II - Mission Critical Sensitive	III - Mission Critical Classified	III - Mission Critical Public	III - Mission Critical Sensitive

Findings - All

Finding ID	Severity	Title	Description
V-269099	High	Windows Server running Active Directory Certificate Services (AD CS) must be managed by a PAW tier 0.	Verify that a site has set aside one or more PAWs for remote management of AD CS.
V-269098	High	Windows Server hosting Active Directory Certificate Services (AD CS) must enforce Certificate Authority (CA) certificate management approval for certificate requests.	When users are requesting new certificates through AD CS, there must be management approval and awareness for these requests. Without this, a user or bad actor could request certificates they should not have or should not have access to.
V-243506	High	Update access to the directory schema must be restricted to appropriate accounts.	A failure to control update access to the AD Schema object could result in the creation of invalid directory objects and attributes. Applications that rely on AD could fail as a result of invalid formats and values. The presence of invalid directory objects and attributes could cause failures in Windows...
V-243504	Medium	The Windows Time Service on the forest root PDC Emulator must be configured to acquire its time from an external time source.	When the Windows Time service is used to synchronize time on client computers (workstations and servers) throughout an AD forest, the forest root domain PDC Emulator is the normal default to provide the authoritative time source for the entire forest. To obtain an accurate time for itself, the forest root...
V-243503	Medium	Anonymous Access to AD forest data above the rootDSE level must be disabled.	For Windows Server 2003 or above, the dsHeuristics option can be configured to override the default restriction on anonymous access to AD data above the rootDSE level. Anonymous access to AD data could provide valuable account or configuration information to an intruder trying to determine the most effective attack strategies.
V-243502	Medium	Membership to the Schema Admins group must be limited.	The Schema Admins group is a privileged group in a forest root domain. Members of the Schema Admins group can make changes to the schema, which is the framework for the Active Directory forest. Changes to the schema are not frequently required. This group only contains the Built-in Administrator account...
V-243505	Low	Changes to the AD schema must be subject to a documented configuration management process.	Poorly planned or implemented changes to the AD schema could cause the applications that rely on AD (such as web and database servers) to operate incorrectly or not all. Improper changes to the schema could result in changes to AD objects that are incompatible with correct operation of the Windows...

STIG VIEWER