STIGQter: STIG Summary: Microsoft Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 04 May 2021:

The directory service must be configured to terminate LDAP-based network connections to the directory server after five (5) minutes of inactivity.

DISA Rule

SV-226083r569184_rule

Vulnerability Number

V-226083

Group Title

SRG-OS-000163-GPOS-00072

Rule Version

WN12-AD-000014-DC

Severity

CAT III

CCI(s)

• CCI-001133 - The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.

Weight

10

Fix Recommendation

Configure the directory service to terminate LDAP-based network connections to the directory server after five (5) minutes of inactivity.

Open an elevated command prompt.
Enter "ntdsutil".
At the "ntdsutil:" prompt, enter "LDAP policies".
At the "ldap policy:" prompt, enter "connections".
At the "server connections:" prompt, enter "connect to server [host-name]".
(Where [host-name] is the computer name of the domain controller.)
At the "server connections:" prompt, enter "q".
At the "ldap policy:" prompt, enter "Set MaxConnIdleTime to 300".
Enter "Commit Changes" to save.
Enter "Show values" to verify changes.
Enter "q" at the "ldap policy:" and "ntdsutil:" prompts to exit.

Check Contents

Verify the value for MaxConnIdleTime.

Open an elevated command prompt.
Enter "ntdsutil".
At the "ntdsutil:" prompt, enter "LDAP policies".
At the "ldap policy:" prompt, enter "connections".
At the "server connections:" prompt, enter "connect to server [host-name]".
(Where [host-name] is the computer name of the domain controller.)
At the "server connections:" prompt, enter "q".
At the "ldap policy:" prompt, enter "show values".

If the value for MaxConnIdleTime is greater than 300 (the value for five minutes) or it is not specified, this is a finding.

Enter "q" at the "ldap policy:" and "ntdsutil:" prompts to exit.


Alternately, Dsquery can be used to display MaxConnIdleTime:

Open an elevated command prompt.
Enter the following command (on a single line).
dsquery * "cn=Default Query Policy,cn=Query-Policies,cn=Directory Service, cn=Windows NT,cn=Services,cn=Configuration,dc=[forest-name]" -attr LDAPAdminLimits
The quotes are required and dc=[forest-name] is the fully qualified LDAP name of the domain being reviewed (e.g., dc=disaost,dc=mil).

Vulnerability Number

V-226083

Documentable

False

Rule Version

WN12-AD-000014-DC

Severity Override Guidance

Verify the value for MaxConnIdleTime.

Open an elevated command prompt.
Enter "ntdsutil".
At the "ntdsutil:" prompt, enter "LDAP policies".
At the "ldap policy:" prompt, enter "connections".
At the "server connections:" prompt, enter "connect to server [host-name]".
(Where [host-name] is the computer name of the domain controller.)
At the "server connections:" prompt, enter "q".
At the "ldap policy:" prompt, enter "show values".

If the value for MaxConnIdleTime is greater than 300 (the value for five minutes) or it is not specified, this is a finding.

Enter "q" at the "ldap policy:" and "ntdsutil:" prompts to exit.


Alternately, Dsquery can be used to display MaxConnIdleTime:

Open an elevated command prompt.
Enter the following command (on a single line).
dsquery * "cn=Default Query Policy,cn=Query-Policies,cn=Directory Service, cn=Windows NT,cn=Services,cn=Configuration,dc=[forest-name]" -attr LDAPAdminLimits
The quotes are required and dc=[forest-name] is the fully qualified LDAP name of the domain being reviewed (e.g., dc=disaost,dc=mil).

Check Content Reference

M

Target Key

4217

Comments