Windows Server 2019 must be configured for certificate-based authentication for domain controllers.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-271428 | WN19-DC-000391 | SV-271428r1059563_rule | CCI-000213 | medium |
| Description | ||||
| Active Directory domain services elevation of privilege vulnerability could allow a user rights to the system, such as administrative and other high-level capabilities. | ||||
| STIG | Date | |||
| Microsoft Windows Server 2019 Security Technical Implementation Guide | 2025-05-23 | |||
Details
Check Text (C-271428r1059563_chk)
This applies to domain controllers. This is not applicable for member servers.
If the following registry value does not exist or is not configured as specified, this is a finding:
Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: SYSTEM\CurrentControlSet\Services\Kdc
Value Name: StrongCertificateBindingEnforcement
Value Type: REG_DWORD
Value: 0x00000001 (1) or 0x00000002 (2)
Fix Text (F-75384r1059562_fix)
Configure the registry value.
Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: SYSTEM\CurrentControlSet\Services\Kdc
Value Name: StrongCertificateBindingEnforcement
Value Type: REG_DWORD
Value: 0x00000001 (1) or 0x00000002 (2)