Detections
Analytics
WN25-DC-000405 - Windows Server 2025 must be configured for certificate-based authentication for domain controllers.
Information
Active Directory domain services elevation of privilege vulnerability could allow a user rights to the system, such as administrative and other high-level capabilities.Solution
Configure the registry value.Registry Hive:
HKEY_LOCAL_MACHINE
Registry Path: SYSTEM\CurrentControlSet\Services\Kdc
Value Name: StrongCertificateBindingEnforcement
Value Type: REG_DWORD
Value: 0x00000001 (1) or 0x00000002 (2)
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2025_V1R1_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows Server 2025 STIG v1r1
Category: ACCESS CONTROL
References: 800-53|AC-3, CAT|II, CCI|CCI-000213, Rule-ID|SV-278172r1182145_rule, STIG-ID|WN25-DC-000405, Vuln-ID|V-278172
Plugin: Windows
Control ID: ebc706db73d6658301e61224cd0c7ba1d306ad6f59c8309af82d0c71a9384b99