STIGQter: STIG Summary: Microsoft Windows Server 2016 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 04 May 2021: STIGQter: STIG Summary: Microsoft Windows Server 2016 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 04 May 2021:SV-224973r569186_rule
V-224973
SRG-OS-000324-GPOS-00125
WN16-DC-000100
CAT I
10
Limit the permissions on the Domain Controllers OU to restrict changes to System, Domain Admins, Enterprise Admins and Administrators.
The default permissions listed below satisfy this requirement.
Domains supporting Microsoft Exchange will have additional Exchange related permissions on the Domain Controllers OU. These may include some change related permissions.
CREATOR OWNER - Special permissions
SELF - Special permissions
Authenticated Users - Read, Special permissions
The special permissions for Authenticated Users are Read types.
SYSTEM - Full Control
Domain Admins - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions
Enterprise Admins - Full Control
Key Admins - Special permissions
Enterprise Key Admins - Special permissions
Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions
Pre-Windows 2000 Compatible Access - Special permissions
The special permissions for Pre-Windows 2000 Compatible Access are Read types.
ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions
This applies to domain controllers. It is NA for other systems.
Review the permissions on the Domain Controllers OU.
Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc").
Select "Advanced Features" in the "View" menu if not previously selected.
Select the "Domain Controllers" OU (folder in folder icon).
Right-click and select "Properties".
Select the "Security" tab.
If the permissions on the Domain Controllers OU do not restrict changes to System, Domain Admins, Enterprise Admins and Administrators, this is a finding.
The default permissions listed below satisfy this requirement.
Domains supporting Microsoft Exchange will have additional Exchange related permissions on the Domain Controllers OU. These may include some change related permissions and are not a finding.
The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "View" or "Edit" button.
Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement.
CREATOR OWNER - Special permissions
SELF - Special permissions
Authenticated Users - Read, Special permissions
The special permissions for Authenticated Users are Read types.
If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding.
SYSTEM - Full Control
Domain Admins - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions
Enterprise Admins - Full Control
Key Admins - Special permissions
Enterprise Key Admins - Special permissions
Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions
Pre-Windows 2000 Compatible Access - Special permissions
The Special permissions for Pre-Windows 2000 Compatible Access are Read types.
If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding.
ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions
V-224973
False
WN16-DC-000100
This applies to domain controllers. It is NA for other systems.
Review the permissions on the Domain Controllers OU.
Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc").
Select "Advanced Features" in the "View" menu if not previously selected.
Select the "Domain Controllers" OU (folder in folder icon).
Right-click and select "Properties".
Select the "Security" tab.
If the permissions on the Domain Controllers OU do not restrict changes to System, Domain Admins, Enterprise Admins and Administrators, this is a finding.
The default permissions listed below satisfy this requirement.
Domains supporting Microsoft Exchange will have additional Exchange related permissions on the Domain Controllers OU. These may include some change related permissions and are not a finding.
The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "View" or "Edit" button.
Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement.
CREATOR OWNER - Special permissions
SELF - Special permissions
Authenticated Users - Read, Special permissions
The special permissions for Authenticated Users are Read types.
If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding.
SYSTEM - Full Control
Domain Admins - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions
Enterprise Admins - Full Control
Key Admins - Special permissions
Enterprise Key Admins - Special permissions
Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions
Pre-Windows 2000 Compatible Access - Special permissions
The Special permissions for Pre-Windows 2000 Compatible Access are Read types.
If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding.
ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions
M
4205