STIGQter: STIG Summary: Active Directory Forest Security Technical Implementation Guide (STIG) Version: 2 Release: 8 Benchmark Date: 27 Jul 2018:

Update access to the directory schema must be restricted to appropriate accounts.

DISA Rule

SV-30999r4_rule

Vulnerability Number

V-15372

Group Title

Directory Schema Update Access

Rule Version

DS00.3140_AD

Severity

CAT I

CCI(s)

• CCI-002235 - The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Weight

10

Fix Recommendation

Ensure the access control permissions for the AD Schema object conform to the required permissions as shown below.

Authenticated Users:
Read
Special Permissions
The Special permissions for Authenticated Users are List and Read type. If detailed permissions include any additional Permissions or Properties this is a finding.

System:
Full Control

Enterprise Read-only Domain Controllers:
Replicating Directory Changes
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set

Schema Admins:
Read
Write
Create all child objects
Change schema master
Manage replication topology
Monitor active directory replication
Read only replication secret synchronization
Reanimate tombstones
Replicating Directory Changes
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set
Replication synchronization
Update schema cache
Special permissions
(Special permissions = all except Full, Delete, and Delete subtree when detailed permissions viewed.)

Administrators:
Manage replication topology
Replicating Directory Changes
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set
Replication Synchronization

Enterprise Domain Controllers:
Manage replication topology
Replicating Directory Changes
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set
Replication Synchronization

Check Contents

Start a Schema management console. (See supplemental notes.)
Select, then right-click on the Active Directory Schema entry in the left pane.
Select Permissions.

If any of the permissions for the Schema object are not at least as restrictive as those below, this is a finding.

The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the Advanced button, selecting the desired entry, and the Edit button.

Authenticated Users:
Read
Special Permissions
The Special permissions for Authenticated Users are List and Read type. If detailed permissions include any additional Permissions or Properties this is a finding.

System:
Full Control

Enterprise Read-only Domain Controllers:
Replicating Directory Changes
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set

Schema Admins:
Read
Write
Create all child objects
Change schema master
Manage replication topology
Monitor active directory replication
Read only replication secret synchronization
Reanimate tombstones
Replicating Directory Changes
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set
Replication synchronization
Update schema cache
Special permissions
(Special permissions = all except Full, Delete, and Delete subtree when detailed permissions viewed.)

Administrators:
Manage replication topology
Replicating Directory Changes
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set
Replication Synchronization

Enterprise Domain Controllers:
Manage replication topology
Replicating Directory Changes
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set
Replication Synchronization

Supplemental Notes:
If the Schema management console has not already been configured on the computer, create a console by using the following:

The steps for adding the snap-in may vary depending on the Windows version.
Register the required DLL module by typing the following at a command line "regsvr32 schmmgmt.dll".
Run "mmc.exe" to start a Microsoft Management Console.
Select Add/Remove Snap-in from the File menu.
From the Available Standalone Snap-ins list, select Active Directory Schema
Select the Add button.
Select the OK button.

When done using the console, select Exit from the File (or Console) menu.
Select the No button to the Save console settings… prompt (unless the SA wishes to retain this console). If the console is retained, the recommended name is schmmgmt.msc and the recommended location is the [systemroot]\system32 directory.

Vulnerability Number

V-15372

Documentable

False

Rule Version

DS00.3140_AD

Severity Override Guidance

Start a Schema management console. (See supplemental notes.)
Select, then right-click on the Active Directory Schema entry in the left pane.
Select Permissions.

If any of the permissions for the Schema object are not at least as restrictive as those below, this is a finding.

The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the Advanced button, selecting the desired entry, and the Edit button.

Authenticated Users:
Read
Special Permissions
The Special permissions for Authenticated Users are List and Read type. If detailed permissions include any additional Permissions or Properties this is a finding.

System:
Full Control

Enterprise Read-only Domain Controllers:
Replicating Directory Changes
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set

Schema Admins:
Read
Write
Create all child objects
Change schema master
Manage replication topology
Monitor active directory replication
Read only replication secret synchronization
Reanimate tombstones
Replicating Directory Changes
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set
Replication synchronization
Update schema cache
Special permissions
(Special permissions = all except Full, Delete, and Delete subtree when detailed permissions viewed.)

Administrators:
Manage replication topology
Replicating Directory Changes
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set
Replication Synchronization

Enterprise Domain Controllers:
Manage replication topology
Replicating Directory Changes
Replicating Directory Changes All
Replicating Directory Changes In Filtered Set
Replication Synchronization

Supplemental Notes:
If the Schema management console has not already been configured on the computer, create a console by using the following:

The steps for adding the snap-in may vary depending on the Windows version.
Register the required DLL module by typing the following at a command line "regsvr32 schmmgmt.dll".
Run "mmc.exe" to start a Microsoft Management Console.
Select Add/Remove Snap-in from the File menu.
From the Available Standalone Snap-ins list, select Active Directory Schema
Select the Add button.
Select the OK button.

When done using the console, select Exit from the File (or Console) menu.
Select the No button to the Save console settings… prompt (unless the SA wishes to retain this console). If the console is retained, the recommended name is schmmgmt.msc and the recommended location is the [systemroot]\system32 directory.

Check Content Reference

M

Responsibility

Information Assurance Officer

Target Key

871

Comments