Detections
Analytics
WDNS-SC-000030 - The Windows 2012 DNS Server must maintain the integrity of information during reception.
Information
Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information.Solution
Sign, or re-sign, the hosted zone(s) on the DNS server being validated.Log on to the Windows 2012 DNS server using the Domain Admin or Enterprise Admin account.
Press Windows Key + R, execute dnsmgmt.msc.
On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server, and then expand Forward Lookup Zones.
From the expanded list, right-click to select the zone (repeat for each hosted zone), point to DNSSEC, and then click Sign the Zone, either using approved saved parameters or approved custom parameters.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_2012_Server_DNS_V2R7_STIG.zip
Item Details
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-8(2), CAT|II, CCI|CCI-002420, Rule-ID|SV-215636r961641_rule, STIG-ID|WDNS-SC-000030, STIG-Legacy|SV-73135, STIG-Legacy|V-58705, Vuln-ID|V-215636
Plugin: Windows
Control ID: d8fd382ca8c0e5f1d39cef5c50a6a406d5a170b3a61782b79d97f9207851b63d