Detections
Analytics
WN19-DC-000391 - Windows Server 2019 must be configured for certificate-based authentication for domain controllers.
Information
Active Directory domain services elevation of privilege vulnerability could allow a user rights to the system, such as administrative and other high-level capabilities.Solution
Configure the registry value.Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: SYSTEM\CurrentControlSet\Services\Kdc
Value Name: StrongCertificateBindingEnforcement
Value Type: REG_DWORD
Value: 0x00000001 (1) or 0x00000002 (2)
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2019_V3R8_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows Server 2019 STIG v3r8
Category: ACCESS CONTROL
References: 800-53|AC-3, CAT|II, CCI|CCI-000213, Rule-ID|SV-271428r1137691_rule, STIG-ID|WN19-DC-000391, Vuln-ID|V-271428
Plugin: Windows
Control ID: b3b83c9fd48b04a2b632b1fd82a6056fda2425c7e0ab17e768ed73026dcc19e9