STIGQter: STIG Summary: Active Directory Forest Security Technical Implementation Guide (STIG) Version: 2 Release: 8 Benchmark Date: 27 Jul 2018:

Anonymous Access to AD forest data above the rootDSE level must be disabled.

DISA Rule

SV-9052r2_rule

Vulnerability Number

V-8555

Group Title

DS10.0230 dsHeuristics Option

Rule Version

AD.0230

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Disable anonymous access to AD forest data above the rootDSE level.

Check Contents

1. At the command line prompt enter (on a single line):
dsquery * "cn=Directory Service,
cn=Windows NT,cn=Services,cn=Configuration,dc=[forest-name]" -scope base -attr *

(Where dc=[forest-name] is the fully qualified LDAP name of the root of the domain being reviewed.)

Example:
The following is an example of the dsquery command for the vcfn.ost.com forest.

dsquery * "cn=Directory Service,cn=Windows NT,cn=Services,cn=Configuration, dc=vcfn,dc=ost,dc=com -scope base -attr *

2. If the dsHeuristics attribute is listed, note the assigned value.

3. If the dsHeuristics attribute is defined and has a “2” as the 7th character, then this is a finding.

Examples of values that would be a finding as follows:
“0000002”, “0010002”, “0000002000001”.
(The 7th character controls anonymous access.)

Supplementary Notes:
Domain controllers have this option disabled by default. However, this check verifies that the option has not been enabled.

The dsHeuristics option can be configured with the Windows Support Tools Active Directory Service Interfaces Editor (ADSI Edit) console (adsiedit.msc).

Vulnerability Number

V-8555

Documentable

False

Rule Version

AD.0230

Severity Override Guidance

1. At the command line prompt enter (on a single line):
dsquery * "cn=Directory Service,
cn=Windows NT,cn=Services,cn=Configuration,dc=[forest-name]" -scope base -attr *

(Where dc=[forest-name] is the fully qualified LDAP name of the root of the domain being reviewed.)

Example:
The following is an example of the dsquery command for the vcfn.ost.com forest.

dsquery * "cn=Directory Service,cn=Windows NT,cn=Services,cn=Configuration, dc=vcfn,dc=ost,dc=com -scope base -attr *

2. If the dsHeuristics attribute is listed, note the assigned value.

3. If the dsHeuristics attribute is defined and has a “2” as the 7th character, then this is a finding.

Examples of values that would be a finding as follows:
“0000002”, “0010002”, “0000002000001”.
(The 7th character controls anonymous access.)

Supplementary Notes:
Domain controllers have this option disabled by default. However, this check verifies that the option has not been enabled.

The dsHeuristics option can be configured with the Windows Support Tools Active Directory Service Interfaces Editor (ADSI Edit) console (adsiedit.msc).

Check Content Reference

M

Responsibility

System Administrator

Target Key

871

Comments