STIGQter: STIG Summary: Active Directory Domain Security Technical Implementation Guide Version: 3 Release: 7 Benchmark Date: 01 Apr 2026:

Security identifiers (SIDs) must be configured to use only authentication data of directly trusted external or forest trust.

DISA Rule

SV-243484r958482_rule

Vulnerability Number

V-243484

Group Title

SRG-OS-000104

Rule Version

AD.0190

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

Ensure SID filtering is enabled on all external trusts. You can enable SID filtering only from the trusting side of the trust. Enter the following line from a command line:

netdom trust <TrustingDomainName> /d:<TrustedDomainName> /quarantine:Yes
/usero:<DomainAdministratorAcct> /passwordo:<DomainAdminPwd>

Ensure SID history is disabled for all forest trusts. You can disable SID history only from the trusting side of the trust. Enter the following line from a command line:

netdom trust <TrustingDomainName> /d:<TrustedDomainName> /enablesidhistory:No
/usero:<DomainAdministratorAcct> /passwordo:<DomainAdminPwd>

Check Contents

Open "Active Directory Domains and Trusts". (Available from various menus or run "domain.msc".)

Right-click the domain in the left pane and select "Properties".

Select the "Trusts" tab.

Note any existing trusts and the type.

If no trusts exist, this is NA.

Access a command line and run the following command on the trusting domain:
"netdom trust <trusting domain> /d:<trusted domain> /quarantine"

If the result does not specify the following, this is a finding.

"SID filtering is enabled for this trust. Only SIDs from the trusted domain will be accepted for authorization data returned during authentication. SIDs from other domains will be removed."

If the trust type is Forest, run the following command on the trusting domain:
"netdom trust <trusting domain> /d:<trusted domain> /enablesidhistory"

If the result does not specify "SID history is disabled for this trust", this is a finding.

Vulnerability Number

V-243484

Documentable

False

Rule Version

AD.0190

Severity Override Guidance

Open "Active Directory Domains and Trusts". (Available from various menus or run "domain.msc".)

Right-click the domain in the left pane and select "Properties".

Select the "Trusts" tab.

Note any existing trusts and the type.

If no trusts exist, this is NA.

Access a command line and run the following command on the trusting domain:
"netdom trust <trusting domain> /d:<trusted domain> /quarantine"

If the result does not specify the following, this is a finding.

"SID filtering is enabled for this trust. Only SIDs from the trusted domain will be accepted for authorization data returned during authentication. SIDs from other domains will be removed."

If the trust type is Forest, run the following command on the trusting domain:
"netdom trust <trusting domain> /d:<trusted domain> /enablesidhistory"

If the result does not specify "SID history is disabled for this trust", this is a finding.

Check Content Reference

M

Target Key

5406