| Vuln ID | Severity | Asset | STIG | Title | Status | Doc Status | Assigned To | Actions |
|---|---|---|---|---|---|---|---|---|
| V-243484 | CAT II | MONT-DC-003 | Active Directory Domain Security Technic... | Security identifiers (SIDs) must be configured to ... | - | |||
Check TextOpen "Active Directory Domains and Trusts". (Available from various menus or run "domain.msc".) Right-click the domain in the left pane and select "Properties". Select the "Trusts" tab. Note any existing trusts and the type. If no trusts exist, this is NA. Access a command line and run the following command on the trusting domain: "netdom trust <trusting domain> /d:<trusted domain> /quarantine" If the result does not specify the following, this is a finding. "SID filtering is enabled for this trust. Only SIDs from the trusted domain will be accepted for authorization data returned during authentication. SIDs from other domains will be removed." If the trust type is Forest, run the following command on the trusting domain: "netdom trust <trusting domain> /d:<trusted domain> /enablesidhistory" If the result does not specify "SID history is disabled for this trust", this is a finding. Fix TextEnsure SID filtering is enabled on all external trusts. You can enable SID filtering only from the trusting side of the trust. Enter the following line from a command line: netdom trust <TrustingDomainName> /d:<TrustedDomainName> /quarantine:Yes /usero:<DomainAdministratorAcct> /passwordo:<DomainAdminPwd> Ensure SID history is disabled for all forest trusts. You can disable SID history only from the trusting side of the trust. Enter the following line from a command line: netdom trust <TrustingDomainName> /d:<TrustedDomainName> /enablesidhistory:No /usero:<DomainAdministratorAcct> /passwordo:<DomainAdminPwd> Finding DetailsEvaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 8AD1942BAC2D1AFD7EFD3D0B16A6E76B5300CD0B ~~~~~ No 'External' or 'Forest' trusts are configured so this requirement is NA.
Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl
Scan Date: 2026-01-14T12:57:36.435963
Technology Area: Domain Name System
|
||||||||