WN12-AD-000005-DC - Domain created Active Directory Organizational Unit (OU) objects must have proper access control permissions.

Information

When directory service database objects do not have appropriate access control permissions, it may be possible for malicious users to create, read, update, or delete the objects and degrade or destroy the integrity of the data. When the directory service is used for identification, authentication, or authorization functions, a compromise of the database objects could lead to a compromise of all systems that rely on the directory service.

For Active Directory (AD), the Organizational Unit (OU) objects require special attention. In a distributed administration model (i.e., help desk), OU objects are more likely to have access permissions changed from the secure defaults. If inappropriate access permissions are defined for OU objects, it could allow an intruder to add or delete users in the OU. This could result in unauthorized access to data or a Denial of Service to authorized users.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Ensure the permissions on domain defined OUs are at least as restrictive as the defaults below.

Document any additional permissions above read with the ISSO if an approved distributed administration model (help desk or other user support staff) is implemented.

Self - Special permissions

Authenticated Users - Read, Special permissions
The Special permissions for Authenticated Users are Read type. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding.

SYSTEM - Full Control

Domain Admins - Full Control

Enterprise Admins - Full Control

Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions

Pre-Windows 2000 Compatible Access - Special permissions
The Special permissions for Pre-Windows 2000 Compatible Access are for Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding.

ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions

Severity Override Guidance: If any OU with improper permissions includes identification or authentication data (e.g., accounts, passwords, or password hash data) used by systems to determine access control, the severity is CAT I (e.g., OUs that include user accounts, including service/application accounts).

If the OU with improper permissions does not include identification and authentication data used by systems to determine access control, the severity is CAT II (e.g., Workstation, Printer OUs).

Item Details

Audit Name: DISA Windows Server 2012 and 2012 R2 DC STIG v3r7

Category: ACCESS CONTROL

Plugin: Windows

Control ID: 550eb837cccb281f31ad1e1a47218d07d646fad60df4f9d9cc46945804b96952

Detections

Analytics

WN12-AD-000005-DC - Domain created Active Directory Organizational Unit (OU) objects must have proper access control permissions.

Information

Solution

See Also

Item Details