STIGQter: STIG Summary: Active Directory Forest Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 02 Jul 2025:

Changes to the AD schema must be subject to a documented configuration management process.

DISA Rule

SV-243505r1026206_rule

Vulnerability Number

V-243505

Group Title

SRG-OS-000480

Rule Version

DS00.0100_AD

Severity

CAT III

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Document and implement a policy to ensure that changes to the AD schema are subject to a configuration management process.

Check Contents

1. Interview the ISSO.

2. Obtain a copy of the site's configuration management procedures documentation.

3. Verify that there is a local policy that requires changes to the directory schema to be processed through a configuration management process. This applies to directory schema changes whether implemented in a database or other types of files. For AD, this refers to changes to the AD schema.

4. If there is no policy that requires changes to the directory schema to be processed through a configuration management process, then this is a finding.

Vulnerability Number

V-243505

Documentable

False

Rule Version

DS00.0100_AD

Severity Override Guidance

1. Interview the ISSO.

2. Obtain a copy of the site's configuration management procedures documentation.

3. Verify that there is a local policy that requires changes to the directory schema to be processed through a configuration management process. This applies to directory schema changes whether implemented in a database or other types of files. For AD, this refers to changes to the AD schema.

4. If there is no policy that requires changes to the directory schema to be processed through a configuration management process, then this is a finding.

Check Content Reference

M

Target Key

5407