Detections
Analytics

1.157 WN22-DC-000070

Information

Windows Server 2022 permissions on the Active Directory data files must only allow System and Administrators access.

GROUP ID: V-254391
RULE ID: SV-254391r958726

Improper access permissions for directory data-related files could allow unauthorized users to read, modify, or delete directory data or audit trails.

Satisfies: SRG-OS-000324-GPOS-00125, SRG-OS-000206-GPOS-00084

Solution

Maintain the permissions on NTDS database and log files as follows:

NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)

(I) - permission inherited from parent container
(F) - full access

See Also

https://workbench.cisecurity.org/benchmarks/28297

Item Details

Category: ACCESS CONTROL, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AC-6(10), 800-53|SI-11b., CCI|CCI-001314, CCI|CCI-002235, Rule-ID|SV-254391r958726_rule, STIG-ID|WN22-DC-000070, Vuln-ID|V-254391

Plugin: Windows

Control ID: d447c392754ac78909e25c0d0c3a06f5a27b858f67454707627226c1f06415f3