STIGQter: STIG Summary: Microsoft Windows 2012 Server Domain Name System Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

WINS lookups must be disabled on the Windows 2012 DNS Server.

DISA Rule

SV-215614r561297_rule

Vulnerability Number

V-215614

Group Title

SRG-APP-000422-DNS-000055

Rule Version

WDNS-SC-000006

Severity

CAT II

CCI(s)

• CCI-002462 - The information system provides additional data integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.

Weight

10

Fix Recommendation

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press Windows Key + R, execute dnsmgmt.msc.

On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server, and then expand Forward Lookup Zones.

From the expanded list, right-click each zone, and then click “Properties”.

In the “Properties” dialog box for the zone, click the “WINS” tab.

Uncheck the "Use WINS forward" lookup check box.

Click “OK”.

Check Contents

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press Windows Key + R, execute dnsmgmt.msc.

On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server, and then expand Forward Lookup Zones.

From the expanded list, right-click each zone, and then click “Properties”.

In the “Properties” dialog box for the zone, click the “WINS” tab.

Verify the "Use WINS forward lookup" check box is not selected.

If the "Use WINS forward lookup" check box is selected, this is a finding.

Vulnerability Number

V-215614

Documentable

False

Rule Version

WDNS-SC-000006

Severity Override Guidance

Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account.

Press Windows Key + R, execute dnsmgmt.msc.

On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server, and then expand Forward Lookup Zones.

From the expanded list, right-click each zone, and then click “Properties”.

In the “Properties” dialog box for the zone, click the “WINS” tab.

Verify the "Use WINS forward lookup" check box is not selected.

If the "Use WINS forward lookup" check box is selected, this is a finding.

Check Content Reference

M

Target Key

4016

Comments