STIGQter STIGQter: STIG Summary: Windows Server 2008 R2 Domain Controller Security Technical Implementation Guide Version: 1 Release: 31 Benchmark Date: 26 Jul 2019: Active Directory Group Policy objects must be configured with proper audit settings.

DISA Rule

SV-55015r3_rule

Vulnerability Number

V-39325

Group Title

WINAU-000207-DC

Rule Version

WINAU-000207-DC

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the audit settings for Group Policy objects to include the following.

This can be done at the Policy level in Active Directory to apply to all group policies.

Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc").

Select "Advanced Features" from the "View" Menu.

Navigate to [Domain] >> System >> Policies in the left panel.

Right click "Policies", select "Properties".

Select the "Security" tab.

Select the "Advanced" button.

Select the "Auditing" tab.

Type - Fail
Name - Everyone
Access - Full Control
Applies To - Descendant groupPolicyContainer objects

The three Success types listed below are defaults Inherited From the Parent Object. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference.

Type - Success
Name - Everyone
Access - Special (Permissions: Write all properties, Modify permissions; Properties: all "Write" type selected)
Inherited From - Parent Object
Applies To - Descendant groupPolicyContainer objects

Two instances with the following summary information will be listed.
Type - Success
Name - Everyone
Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions)
Inherited From - Parent Object
Applies To - Descendant Organization Unit objects

Check Contents

Review the auditing configuration for all Group Policy objects.

Open "Group Policy Management". (Available from various menus, or run "gpmc.msc".)

Navigate to "Group Policy Objects" in the domain being reviewed (Forest >> Domains >> Domain).

For each Group Policy object:

Select the Group Policy Object item in the left pane.

Select the "Delegation" tab in the right pane.

Select the "Advanced" button.

Select the "Advanced" button again and then the "Auditing" tab.

If the audit settings for any Group Policy object are not at least as inclusive as those below, this is a finding.

Type - Fail
Name - Everyone
Access - Full Control
Applies To - Descendant groupPolicyContainer objects

The three Success types listed below are defaults Inherited From the Parent Object. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference.

Type - Success
Name - Everyone
Access - Special (Permissions: Write all properties, Modify permissions; Properties: all "Write" type selected)
Inherited From - Parent Object
Applies To - Descendant groupPolicyContainer objects

Two instances with the following summary information will be listed.
Type - Success
Name - Everyone
Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions)
Inherited From - Parent Object
Applies To - Descendant Organization Unit objects

Vulnerability Number

V-39325

Documentable

False

Rule Version

WINAU-000207-DC

Severity Override Guidance

Review the auditing configuration for all Group Policy objects.

Open "Group Policy Management". (Available from various menus, or run "gpmc.msc".)

Navigate to "Group Policy Objects" in the domain being reviewed (Forest >> Domains >> Domain).

For each Group Policy object:

Select the Group Policy Object item in the left pane.

Select the "Delegation" tab in the right pane.

Select the "Advanced" button.

Select the "Advanced" button again and then the "Auditing" tab.

If the audit settings for any Group Policy object are not at least as inclusive as those below, this is a finding.

Type - Fail
Name - Everyone
Access - Full Control
Applies To - Descendant groupPolicyContainer objects

The three Success types listed below are defaults Inherited From the Parent Object. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference.

Type - Success
Name - Everyone
Access - Special (Permissions: Write all properties, Modify permissions; Properties: all "Write" type selected)
Inherited From - Parent Object
Applies To - Descendant groupPolicyContainer objects

Two instances with the following summary information will be listed.
Type - Success
Name - Everyone
Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions)
Inherited From - Parent Object
Applies To - Descendant Organization Unit objects

Check Content Reference

M

Target Key

1823

Comments