Windows Server 2022 must be configured for certificate-based authentication for domain controllers.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-271426 | WN22-DC-000405 | SV-271426r1059557_rule | Medium |
| Description |
| Active Directory domain services elevation of privilege vulnerability could allow a user rights to the system, such as administrative and other high-level capabilities. |
| STIG | Date |
| Microsoft Windows Server 2022 Security Technical Implementation Guide | 2025-01-14 |
Details
| Check Text (C-75475r1059555_chk) |
| This applies to domain controllers. This is not applicable for member servers. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: SYSTEM\CurrentControlSet\Services\Kdc Value Name: StrongCertificateBindingEnforcement Value Type: REG_DWORD Value: 0x00000001 (1) or 0x00000002 (2) |
| Fix Text (F-75382r1059556_fix) |
| Configure the registry value. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: SYSTEM\CurrentControlSet\Services\Kdc Value Name: StrongCertificateBindingEnforcement Value Type: REG_DWORD Value: 0x00000001 (1) or 0x00000002 (2) |