V-269099
Active Directory Forest Security Technical Implementation Guide
Title
Windows Server running Active Directory Certificate Services (AD CS) must be managed by a PAW tier 0.
Description
<VulnDiscussion>Verify that a site has set aside one or more PAWs for remote management of AD CS. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
Fix Text (Documentation Requirement)
Configure and set aside one or more PAWs for configuration and management of AD CS. For AD, multiple configuration items could enable anonymous access. Set aside one or more PAWs for remote management of high-value IT resources assigned to a specific tier. For example, using the Microsoft Tier 0-2 model, each PAW would be assigned to manage Tier 0, Tier 1, or Tier 2 high-value IT resources.