Windows Server 2019 must be configured for certificate-based authentication for domain controllers.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-271428 | WN19-DC-000391 | SV-271428r1059563_rule | Medium |
| Description |
| Active Directory domain services elevation of privilege vulnerability could allow a user rights to the system, such as administrative and other high-level capabilities. |
| STIG | Date |
| Microsoft Windows Server 2019 Security Technical Implementation Guide | 2025-01-15 |
Details
| Check Text (C-75477r1059561_chk) |
| This applies to domain controllers. This is not applicable for member servers. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: SYSTEM\CurrentControlSet\Services\Kdc Value Name: StrongCertificateBindingEnforcement Value Type: REG_DWORD Value: 0x00000001 (1) or 0x00000002 (2) |
| Fix Text (F-75384r1059562_fix) |
| Configure the registry value. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: SYSTEM\CurrentControlSet\Services\Kdc Value Name: StrongCertificateBindingEnforcement Value Type: REG_DWORD Value: 0x00000001 (1) or 0x00000002 (2) |