STIGQter: STIG Summary: Active Directory Domain Security Technical Implementation Guide Version: 3 Release: 7 Benchmark Date: 01 Apr 2026:

The Directory Service Restore Mode (DSRM) passwords must be changed on each Domain Controller (DC) at least annually.

DISA Rule

SV-243479r1153403_rule

Vulnerability Number

V-243479

Group Title

SRG-OS-000480

Rule Version

AD.0151

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Change the DSRM passwords on each DC at least annually with the following commands:

C:\> ntdsutil
C:\Windows\system32\ntdsutil.exe: Set DSRM Password
Reset DSRM Administrator Password: Reset Password on server <servername>
Follow prompts to reset the password.

Check Contents

Verify the DSRM password for each DC is changed at least annually.

If logs are retained locally for a sufficient amount of time to capture the log event, the following command will indicate the password reset:
PS C:\> Get-WinEvent -FilterHashtable @{Logname='Security'; ID=4794} | Format-Table -Property TimeCreated, Message

TimeCreated Message
----------- -------
10/29/2025 4:47:12 PM An attempt was made to set the Directory Services Restore Mode...

If logs are not available, review the site processes around DSRM password reset to determine compliance.

If DSRM passwords are not changed for each DC in the domain at least annually, this is a finding.

Vulnerability Number

V-243479

Documentable

False

Rule Version

AD.0151

Severity Override Guidance

Verify the DSRM password for each DC is changed at least annually.

If logs are retained locally for a sufficient amount of time to capture the log event, the following command will indicate the password reset:
PS C:\> Get-WinEvent -FilterHashtable @{Logname='Security'; ID=4794} | Format-Table -Property TimeCreated, Message

TimeCreated Message
----------- -------
10/29/2025 4:47:12 PM An attempt was made to set the Directory Services Restore Mode...

If logs are not available, review the site processes around DSRM password reset to determine compliance.

If DSRM passwords are not changed for each DC in the domain at least annually, this is a finding.

Check Content Reference

M

Target Key

5406