Detections
Analytics
WN25-DC-000070 - Windows Server 2025 permissions on the Active Directory data files must only allow system administrators (SAs) access.
Information
Improper access permissions for directory data-related files could allow unauthorized users to read, modify, or delete directory data or audit trails.Satisfies: SRG-OS-000324-GPOS-00125, SRG-OS-000206-GPOS-00084
Solution
Maintain the permissions on NTDS database and log files as follows:NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)
(I) - permission inherited from parent container
(F) - full access
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2025_V1R1_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows Server 2025 STIG v1r1
Category: ACCESS CONTROL, SYSTEM AND INFORMATION INTEGRITY
References: 800-53|AC-6(10), 800-53|SI-11b., CAT|I, CCI|CCI-001314, CCI|CCI-002235, Rule-ID|SV-278138r1182081_rule, STIG-ID|WN25-DC-000070, Vuln-ID|V-278138
Plugin: Windows
Control ID: 4ea8838212fb3b52e7fcedd37083af8c71d1fff8e8f77bb67a228f49630784db