STIGQter: STIG Summary: Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The Windows 2012 DNS Server must follow procedures to re-role a secondary name server as the master name server should the master name server permanently lose functionality.

DISA Rule

SV-215639r561297_rule

Vulnerability Number

V-215639

Group Title

SRG-APP-000451-DNS-000069

Rule Version

WDNS-SI-000002

Severity

CAT II

CCI(s)

• CCI-002754 - The information system behaves in a predictable and documented manner that reflects organizational and system objectives when invalid inputs are received.

Weight

10

Fix Recommendation

Active Directory-integrated DNS servers will handle the promotion of a secondary DNS server whenever a primary DNS server loses functionality.

Develop, test, and implement documented procedures for re-roling a non-AD-integrated secondary name server to a master name server role in the event a master name server loses functionality.

Check Contents

Active Directory integrated DNS servers will handle the promotion of a secondary DNS server whenever a primary DNS server loses functionality.

If all of the DNS servers are AD-integrated, this is not a finding.

Consult with the System Administrator to determine if there are documented procedures for re-roling a non-AD-integrated secondary name server to a master name server role in the event a master name server loses functionality.

If there is not any documented procedures for re-roling a non-AD-integrated secondary name server to primary in the event a master name server loses functionality, this is a finding.

Vulnerability Number

V-215639

Documentable

False

Rule Version

WDNS-SI-000002

Severity Override Guidance

Active Directory integrated DNS servers will handle the promotion of a secondary DNS server whenever a primary DNS server loses functionality.

If all of the DNS servers are AD-integrated, this is not a finding.

Consult with the System Administrator to determine if there are documented procedures for re-roling a non-AD-integrated secondary name server to a master name server role in the event a master name server loses functionality.

If there is not any documented procedures for re-roling a non-AD-integrated secondary name server to primary in the event a master name server loses functionality, this is a finding.

Check Content Reference

M

Target Key

4016

Comments