Detections
Analytics

1.153 WN22-DC-000070

Information

Windows Server 2022 permissions on the Active Directory data files must only allow System and Administrators access.

GROUP ID: V-254391
RULE ID: SV-254391r958726

Improper access permissions for directory data-related files could allow unauthorized users to read, modify, or delete directory data or audit trails.

Satisfies: SRG-OS-000324-GPOS-00125, SRG-OS-000206-GPOS-00084

Solution

Maintain the permissions on NTDS database and log files as follows:

NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)

(I) - permission inherited from parent container
(F) - full access

See Also

https://workbench.cisecurity.org/benchmarks/22357

Item Details

Category: ACCESS CONTROL, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AC-6(10), 800-53|SI-11b., CAT|I, CCI|CCI-001314, CCI|CCI-002235, Rule-ID|SV-254391r958726_rule, STIG-ID|WN22-DC-000070, Vuln-ID|V-254391

Plugin: Windows

Control ID: 2b9b2ec5eec9695edf6aa435901ac01498e86f153a949b4e418834528f5f48cc