STIGQter STIGQter: STIG Summary: Active Directory Domain Security Technical Implementation Guide Version: 3 Release: 7 Benchmark Date: 01 Apr 2026:

Selective Authentication must be enabled on outgoing forest trusts.

DISA Rule

SV-243485r1117265_rule

Vulnerability Number

V-243485

Group Title

SRG-OS-000080

Rule Version

AD.0200

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Enable Selective Authentication on outgoing forest trust.
Open "Active Directory Domains and Trusts". (Available from various menus or run "domain.msc".)
Right click the domain name in the left pane and select "Properties".
Select the "Trusts" tab.
For each outgoing forest trust, right-click the trust item and select "Properties".
Select the "Authentication" tab.
Select the "Selective Authentication" option.
(It may be necessary to configure the "Allowed to Authenticate" permission on resources in the trusting domain.)

Check Contents

Open "Active Directory Domains and Trusts". (Available from various menus or run "domain.msc".)
Right click the domain name in the left pane and select "Properties".
Select the "Trusts" tab.
For each outgoing forest trust, right-click the trust item and select "Properties".
Select the "Authentication" tab.

If the "Selective Authentication" option is not selected on every outgoing forest trust, this is a finding.

Vulnerability Number

V-243485

Documentable

False

Rule Version

AD.0200

Severity Override Guidance

Open "Active Directory Domains and Trusts". (Available from various menus or run "domain.msc".)
Right click the domain name in the left pane and select "Properties".
Select the "Trusts" tab.
For each outgoing forest trust, right-click the trust item and select "Properties".
Select the "Authentication" tab.

If the "Selective Authentication" option is not selected on every outgoing forest trust, this is a finding.

Check Content Reference

M

Target Key

5406