Detections
Analytics

2.2.47 Ensure 'Synchronize directory service data' is set to 'No One' (DC only)

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This security setting determines which users and groups have the authority to synchronize all directory service data. This is also known as Active Directory synchronization.

The recommended state for this setting is: No One.

The Synchronize directory service data user right affects Domain Controllers as only Domain Controllers should be able to synchronize directory service data.

Domain Controllers have this user right inherently, because the synchronization process runs in the context of the System account on Domain Controllers. Threat actors who have this user right can view all information stored within the directory. They could then use some of that information to facilitate additional attacks or expose sensitive data, such as direct telephone numbers or physical addresses.

Solution

To establish the recommended configuration via GP, set the following UI path to No One :

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Synchronize directory service data

Impact:

None - this is the default behavior.

See Also

https://workbench.cisecurity.org/benchmarks/25733

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-2, 800-53|AC-3, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4)

Plugin: Windows

Control ID: 3beb9356e6f751fe011b21f38f2809f2d352e745870b0e97ab5c76cc20d64989