UCF STIG Viewer Logo

Separate domain accounts must be used to manage public facing servers from any domain accounts used to manage internal servers.


Overview

Finding ID Version Rule ID IA Controls Severity
V-243473 AD.0013 SV-243473r723565_rule Medium
Description
Public facing servers should be in DMZs with separate Active Directory forests. If, because of operational necessity, this is not possible, lateral movement from these servers must be mitigated within the forest. Having different domain accounts for administering domain joined public facing servers, from domain accounts used on internal servers, protects against an attacker's lateral movement from a compromised public facing server.
STIG Date
Active Directory Domain Security Technical Implementation Guide 2022-08-26

Details

Check Text ( C-46748r723452_chk )
If the domain does not have any public facing servers, this is NA.

Review the local Administrators group on public facing servers. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group.

For public facing servers, the Domain Admins group must be replaced by a domain member server administrator group whose members are different from any used to manage internal servers.

If any domain accounts or groups used to manage internal servers are members of the local administrators group, this is a finding.
Fix Text (F-46705r723453_fix)
If the domain does not have any public facing servers, this is NA.

Configure the system to include only administrator groups or accounts that are responsible for the system in the local Administrators group.

For public facing servers, replace the Domain Admins group with a domain member server administrator group whose members are different from any used to manage internal servers.