Windows Server 2022 must be configured for certificate-based authentication for domain controllers.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-271426 | WN22-DC-000405 | SV-271426r1059557_rule | CCI-000213 | medium |
| Description | ||||
| Active Directory domain services elevation of privilege vulnerability could allow a user rights to the system, such as administrative and other high-level capabilities. | ||||
| STIG | Date | |||
| Microsoft Windows Server 2022 Security Technical Implementation Guide | 2025-05-15 | |||
Details
Check Text (C-271426r1059557_chk)
This applies to domain controllers. This is not applicable for member servers.
If the following registry value does not exist or is not configured as specified, this is a finding:
Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: SYSTEM\CurrentControlSet\Services\Kdc
Value Name: StrongCertificateBindingEnforcement
Value Type: REG_DWORD
Value: 0x00000001 (1) or 0x00000002 (2)
Fix Text (F-75382r1059556_fix)
Configure the registry value.
Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: SYSTEM\CurrentControlSet\Services\Kdc
Value Name: StrongCertificateBindingEnforcement
Value Type: REG_DWORD
Value: 0x00000001 (1) or 0x00000002 (2)