WDNS-AU-000007 - The Windows 2012 DNS Server logging criteria must only be configured by the ISSM or individuals appointed by the ISSM - permissions

Information

Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. The actual auditing is performed by the OS/NDM, but the configuration to trigger the auditing is controlled by the DNS server.

Since the configuration of the audit logs on the DNS server dictates which events are logged for the purposes of correlating events, the permissions for configuring the audit logs must be restricted to only those with the role of ISSM or those appointed by the ISSM.

Solution

Configure the permissions on the DNS logs.

Standard user accounts or groups must not have greater than READ access.

The default permissions listed below satisfy this requirement:

Eventlog - Full Control
SYSTEM - Full Control
Administrators - Full Control

The default locations are:

DNS Server %SystemRoot%\System32\Winevt\Logs\DNS Server.evtx

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_2012_Server_DNS_V2R5_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT

References: 800-53|AU-12b., 800-53|CM-6b., CAT|II, CCI|CCI-000171, CCI|CCI-000366, Rule-ID|SV-215652r561297_rule, STIG-ID|WDNS-AU-000007, STIG-Legacy|SV-72983, STIG-Legacy|V-58553, Vuln-ID|V-215652

Plugin: Windows

Control ID: 0ea85ac5694108a420814df566d1abe7bc7407024469fbbbe5bfc113b2bb850f