Active Directory Forest Security Technical Implementation Guide (STIG)

V2R4 2014-10-15       U_Active_Directory_Forest_v2r4_STIG_Manual-xccdf.xml
V2R8 2018-05-30       U_Active_Directory_Forest_STIG_V2R8_Manual-xccdf.xml
This STIG provides focused security requirements for the AD or Active Directory Domain Services (AD DS) element for Windows Servers operating systems. These requirements apply to the forest and can typically be reviewed once per AD Forest. The separate Active Directory Domain STIG contains domain level requirements. Systems must also be reviewed using the applicable Windows STIG. Comments or proposed revisions to this document should be sent via e-mail to the following address: [email protected]
Comparison
All 5
No Change 2
Updated 2
Added 0
Removed 1
V-8527 No Change
Findings ID: DS00.0100_AD Rule ID: SV-30998r3_rule Severity: low CCI: CCI-000366

Discussion

Poorly planned or implemented changes to the AD schema could cause the applications that rely on AD (such as web and database servers) to operate incorrectly or not all.

Improper changes to the schema could result in changes to AD objects that are incompatible with correct operation of the Windows domain controller and the domain clients. This could cause outages that prevent users from logging on or accessing Windows server resources across multiple hosts.Information Assurance OfficerInformation Assurance ManagerDCPR-1

Checks

1. Interview the IAO.

2. Obtain a copy of the site’s configuration management procedures documentation.

3. Verify that there is a local policy that requires changes to the directory schema to be processed through a configuration management process. This applies to directory schema changes whether implemented in a database or other types of files. For AD, this refers to changes to the AD schema.

4. If there is no policy that requires changes to the directory schema to be processed through a configuration management process, then this is a finding.

Fix

Document and implement a policy to ensure that changes to the AD schema are subject to a configuration management process.
V-8555 No Change
Findings ID: AD.0230 Rule ID: SV-9052r2_rule Severity: medium CCI: CCI-000366

Discussion

For Windows Server 2003 or above, the dsHeuristics option can be configured to override the default restriction on anonymous access to AD data above the rootDSE level. Anonymous access to AD data could provide valuable account or configuration information to an intruder trying to determine the most effective attack strategies.System AdministratorECAN-1, ECCD-1, ECCD-2

Checks

1. At the command line prompt enter (on a single line):
dsquery * "cn=Directory Service,
cn=Windows NT,cn=Services,cn=Configuration,dc=[forest-name]" -scope base -attr *

(Where dc=[forest-name] is the fully qualified LDAP name of the root of the domain being reviewed.)

Example:
The following is an example of the dsquery command for the vcfn.ost.com forest.

dsquery * "cn=Directory Service,cn=Windows NT,cn=Services,cn=Configuration, dc=vcfn,dc=ost,dc=com -scope base -attr *

2. If the dsHeuristics attribute is listed, note the assigned value.

3. If the dsHeuristics attribute is defined and has a “2” as the 7th character, then this is a finding.

Examples of values that would be a finding as follows:
“0000002”, “0010002”, “0000002000001”.
(The 7th character controls anonymous access.)

Supplementary Notes:
Domain controllers have this option disabled by default. However, this check verifies that the option has not been enabled.

The dsHeuristics option can be configured with the Windows Support Tools Active Directory Service Interfaces Editor (ADSI Edit) console (adsiedit.msc).

Fix

Disable anonymous access to AD forest data above the rootDSE level.
V-8557 Updated
Findings ID: AD.0295 Rule ID: SV-9054r32_rule Severity: medium CCI: CCI-001891

Discussion

When the Windows Time service is used to synchronize time on client computers (workstations and servers) throughout an AD forest, the forest root domain PDC Emulator is the normal default to provide the authoritative time source for the entire forest. To obtain an accurate time for itself, the forest root domain PDC Emulator acts as a client to an external time source.

If the Windows Time service on the forest root domain PDC Emulator is not configured to acquire the time from a proper source, it may cause time service clients throughout the forest to operate with the inaccurate time setting.

When a Windows computer operates with an inaccurate time setting, access to resources on computers with the accurate time might be denied. This is notably true when Kerberos authentication is utilized. Operation with an inaccurate time setting can reduce the value of audit data and invalidate it as a source of forensic evidence in an incident investigation.


Further Policy Details:
The Windows Time service is the preferred time synchronization tool for Windows domain controllers. This check is Not Applicable for Component locations that do not have the AD forest root domain on site. This check must be performed on the domain controller in the *forest root domain* that holds the PDC Emulator FSMO role.
Information Assurance OfficerECTM-1, ECTM-2

Checks

This applies to the domain controller with the PDC emulator role in forest root domain; it is NA for other domain controllers in the forest.

Determine the domain controller with the PDC Emulator role in the forest root domain:

Windows 2008 R2 or later:

Open "Windows PowerShell".

Enter "Get-ADDomain -Identity [Forest Root Domain] | FT PDCEmulator", where [Forest Root Domain] is the forest root domain name, such as "example.mil". (This can also be entered without the -Identity parameter if running within the forest root domain.)

Windows 2008:

Open "Active Directory Users and Computers" from a domain controller in or connected to the forest root (available from various menus or run "dsa.msc").

Select "Action" in the menu, then "All Tasks >> Operations Masters".

Select the "PDC" tab.

On the system with the PDC Emulator role, open "Windows PowerShell" or an elevated "Command Prompt" (run as administrator).

Enter "W32tm /query /configuration".

Under the "NtpClient" section:

If the value for "Type" is not "NTP", this is a finding.

If the value for "NtpServer" is not an external DoD time source, this is a finding.

If an alternate time synchronization tool is used and is not enabled or not configured to a synchronize with an external DoD time source, this is a finding.

The US Naval Observatory operates stratum 1 time servers, identified at http://tycho.usno.navy.mil/ntp.html. Time synchronization will occur through a hierarchy of time servers down to the local level. Clients and lower-level servers will synchronize with an authorized time server in the hierarchy
1. Use Registry Editor to navigate to the following: HLM\System\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient

2. If the value for “Enabled” is not “1”, then this is a finding.

3. Use Registry Editor to navigate to the following: HKLM\System\CurrentControlSet\Services\W32Time\Parameters

4. If the value for “Type” is not “NTP”, then this is a finding.

Note: If these checks indicate a finding because the NtpClient is not enabled, ask the SA to demonstrate that
a) an alternate time synchronization tool is installed and enabled and that
b) a DoD-authorized external time source is being used.

5. If the Windows Time service is not enabled or no alternate tool is installed and enabled in its place, then this is a finding
.

Fix

Configure the forest root PDC Emulator to acquire its time from an external time source.

The
Windows Time Sservice can be configured by setting the policy value for Computer Configuration >> Administrative Templates >> System >> Windows Time Service >> Time Providers >> "Configure Windows NTP Client" to "Enabled", and configure the "NtpServer" field to point to an authorized time serveron the forest root PDC Emulator to acquire its time from an external time source.
V-15372 Updated
Findings ID: DS00.3140_AD Rule ID: SV-30999r43_rule Severity: high CCI: CCI-002235

Discussion

A failure to control update access to the AD Schema object could result in the creation of invalid directory objects and attributes. Applications that rely on AD could fail as a result of invalid formats and values. The presence of invalid directory objects and attributes could cause failures in Windows AD client functions and improper resource access decisions.Information Assurance OfficerECAN-1, ECCD-1, ECCD-2

Checks

Start a Schema management console. (See supplemental notes.)
Select, then right-click on the Active Directory Schema entry in the left pane.
Select Permissions.

If any of the permissions for the Schema object are not at least as restrictive as those below, this is a finding.


The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the Advanced button, selecting the desired entry, and the Edit button.

These permissions are based on Windows 2008 and later. Variances for Windows 2003 are noted where applicable.

Authenticated Users:
Read
Special Permissions
The Special permissions for Authenticated Users are List and Read type. If detailed permissions include any additional Permissions or Properties this is a finding.

System:
Full Control

Enterprise Read-only Domain Controllers:
(NA on Windows 2003)
Replicating Directory Changes
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set

Schema Admins:
Read
Write
Create all child objects
Change schema master
Manage replication topology
Monitor active directory replication
Read only replication secret synchronization
(NA on Windows 2003)
Reanimate tombstones
Replicating Directory Changes
(Replicate Directory Changes on Windows 2003)
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set
(NA on Windows 2003)
Replication synchronization
Update schema cache
Special permissions
(Special permissions = all except Full, Delete, and Delete subtree when detailed permissions viewed.)

Administrators:
Manage replication topology

Administrators:
Manage replication topology
Replicating Directory Changes (
Replicatinge Directory Changes on Windows 2003)
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set
(NA on Windows 2003)
Replication Synchronization

Enterprise Domain Controllers:
Manage replication topology
Replicating Directory Changes
(Replicate Directory Changes on Windows 2003)
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set
(NA on Windows 2003)
Replication Synchronization

Supplemental Notes:
If the Schema management console has not already been configured on the computer, create a console by using the following:

The steps for adding the snap-in may vary depending on the Windows version.
Register the required DLL module by typing the following at a command line "regsvr32 schmmgmt.dll".
Run "mmc.exe" to start a Microsoft Management Console.
Select Add/Remove Snap-in from the File menu.
From the Available Standalone Snap-ins list, select Active Directory Schema
Select the Add button.
Select the OK button.

When done using the console, select Exit from the File (or Console) menu.
Select the No button to the Save console settings… prompt (unless the SA wishes to retain this console). If the console is retained, the recommended name is schmmgmt.msc and the recommended location is the [systemroot]\system32 directory.

Fix

Ensure the access control permissions for the AD Schema object conform to the required permissions as shown below.

Authenticated Users:
Read
Special Permissions
The Special permissions for Authenticated Users are List and Read type. If detailed permissions include any additional Permissions or Properties this is a finding.

System:
Full Control

Enterprise Read-only Domain Controllers:
(NA on Windows 2003)
Replicating Directory Changes
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set

Schema Admins:
Read
Write
Create all child objects
Change schema master
Manage replication topology
Monitor active directory replication
Read only replication secret synchronization
(NA on Windows 2003)
Reanimate tombstones
Replicating Directory Changes
(Replicate Directory Changes on Windows 2003)
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set
(NA on Windows 2003)
Replication synchronization
Update schema cache
Special permissions
(Special permissions = all except Full, Delete, and Delete subtree when detailed permissions viewed.)

Administrators:
Manage replication topology

Administrators:
Manage replication topology
Replicating Directory Changes (
Replicatinge Directory Changes on Windows 2003)
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set
(NA on Windows 2003)
Replication Synchronization

Enterprise Domain Controllers:
Manage replication topology
Replicating Directory Changes
(Replicate Directory Changes on Windows 2003)
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set
(NA on Windows 2003)
Replication Synchronization
V-72835 Removed
Findings ID: AD.0017 Rule ID: SV-87487r1_rule Severity: medium CCI: CCI-000366

Discussion

The Schema Admins group is a privileged group in a forest root domain. Members of the Schema Admins group can make changes to the schema, which is the framework for the Active Directory forest. Changes to the schema are not frequently required. This group only contains the Built-in Administrator account by default. Additional accounts must only be added when changes to the schema are necessary and then must be removed.

Checks

Open "Active Directory Users and Computers" on a domain controller in the forest root domain. Navigate to the "Users" container. Right-click on "Schema Admins" and select "Properties", and then select the "Members" tab. If any accounts other than the built-in Administrators group are members, verify their necessity with the ISSO. If any accounts are members of the group when schema changes are not being made, this is a finding.

Fix

Limit membership in the Schema Admins group to only those accounts necessary during a schema update. Remove accounts when the updates are complete. Document accounts necessary during schema updates with the ISSO.