| Vuln ID | Severity | Asset | STIG | Title | Status | Doc Status | Assigned To | Actions |
|---|---|---|---|---|---|---|---|---|
| V-243491 | CAT II | MONT-DC-003 | Active Directory Domain Security Technic... | Systems must be monitored for attempts to use loca... | - | |||
Check TextVerify attempts to use local accounts to log on remotely from other systems are being monitored. Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools. Monitor for the events listed below. If these events are not monitored, this is a finding. More advanced filtering is necessary to obtain the pertinent information than just looking for event IDs. Search for the event IDs listed with the following additional attributes: Logon Type = 3 (Network) Authentication Package Name = NTLM Not a domain logon and not the ANONYMOUS LOGON account Successful User Account Login (Subcategory: Logon) 4624 - An account was successfully logged on. Failed User Account Login (Subcategory: Logon) 4625 - An account failed to log on. Fix TextMonitor for attempts to use local accounts to log on remotely from other systems. Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools. Monitor for the events listed below. More advanced filtering is necessary to obtain the pertinent information than just looking for event IDs. Search for the event IDs listed with the following additional attributes: Logon Type = 3 (Network) Authentication Package Name = NTLM Not a domain logon and not the ANONYMOUS LOGON account Successful User Account Login (Subcategory: Logon) 4624 - An account was successfully logged on. Failed User Account Login (Subcategory: Logon) 4625 - An account failed to log on. The "Pass the Hash Detection" section of NSA's "Spotting the Adversary with Windows Event Log Monitoring" provides a sample query for filtering. https://www.iad.gov/iad/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm. Finding DetailsEvaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E089DA3611CD9E5684D67E52819E7E3F526453BF ~~~~~ Category: Logon Audit On: Success and Failure Category: Account Lockout Audit On: Success and Failure Queries of Events ===================== Event ID: 4624 Message: An account was successfully logged on. User: - Domain: - Level: Information Container Log: security Time Created: 10/23/2025 17:10:53 Event ID: 4625 Message: An account failed to log on. User: MNOCE-EMV-01$ Domain: ASHORE Level: Information Container Log: security Time Created: 10/23/2025 11:34:02
Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl
Scan Date: 2026-01-14T12:57:36.435963
Technology Area: Domain Name System
|
||||||||