WN12-AD-000002-DC - The Active Directory SYSVOL directory must have the proper access control permissions.

Information

Improper access permissions for directory data files could allow unauthorized users to read, modify, or delete directory data.

The SYSVOL directory contains public files (to the domain) such as policies and logon scripts. Data in shared subdirectories are replicated to all domain controllers in a domain.

Solution

Ensure the permissions on SYSVOL directory do not allow greater than read & execute for standard user accounts or groups. The defaults below meet this requirement.

Type - Allow
Principal - Authenticated Users
Access - Read & execute
Inherited from - None
Applies to - This folder, subfolder and files

Type - Allow
Principal - Server Operators
Access - Read & execute
Inherited from - None
Applies to - This folder, subfolder and files

Type - Allow
Principal - Administrators
Access - Special
Inherited from - None
Applies to - This folder only
(Access - Special - Basic Permissions: all selected except Full control)

Type - Allow
Principal - CREATOR OWNER
Access - Full control
Inherited from - None
Applies to - Subfolders and files only

Type - Allow
Principal - Administrators
Access - Full control
Inherited from - None
Applies to - Subfolders and files only

Type - Allow
Principal - SYSTEM
Access - Full control
Inherited from - None
Applies to - This folder, subfolders and files

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_2012_and_2012_R2_DC_V3R4_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(10), CAT|I, CCI|CCI-002235, Rule-ID|SV-226071r794770_rule, STIG-ID|WN12-AD-000002-DC, STIG-Legacy|SV-51176, STIG-Legacy|V-39331, Vuln-ID|V-226071

Plugin: Windows

Control ID: 772292cf5c8832c4d24e35dce54fdaf48c24861391490f6658d9a48863367034