| Vuln ID | Severity | Asset | STIG | Title | Status | Doc Status | Assigned To | Actions |
|---|---|---|---|---|---|---|---|---|
| V-259338 | CAT II | MONT-DC-003 | Microsoft Windows Server Domain Name Sys... | The "Manage auditing and security log" user right ... | - | |||
Check TextVerify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or groups other than the following are granted the "Manage auditing and security log" user right, this is a finding: Administrators Auditors (if the site has an Auditors group that further limits this privilege) If an application requires this user right, this is not a finding. Vendor documentation must support the requirement for having the user right. The requirement must be documented with the ISSO. The application account must meet requirements for application account passwords. Verify the permissions on the DNS logs. Standard user accounts or groups must not have greater than READ access. The default locations are: DNS Server %SystemRoot%\System32\Winevt\Logs\DNS Server.evtx Use PowerShell and go to PS C:\Windows\System32\winevt\logs> icacls.exe 'dns server .evtx' The default permissions listed below satisfy this requirement: Eventlog - Full Control (I)(F) SYSTEM - Full Control (I)(F) Administrators (I)(F) If the permissions for these files are not as restrictive as the access control lists above, this is a finding. Fix TextConfigure the permissions on the DNS logs. Standard user accounts or groups must not have greater than READ access. The default permissions listed below satisfy this requirement: Eventlog - Full Control SYSTEM - Full Control Administrators - Full Control The default locations are: DNS Server %SystemRoot%\System32\Winevt\Logs\DNS Server.evtx Finding DetailsEvaluate-STIG 1.2507.5 (Scan-WindowsServerDNS_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 8C3CA6264D37EAFBFDCFA35DB1F7281C237588D2 ~~~~~ Manage auditing and security log: BUILTIN\Administrators Exchange Servers S-1-5-21-1199390858-2101972093-2013113664-1129 S-1-5-21-270843172-1021756428-1876623829-2158 C:\windows\System32\Winevt\Logs\DNS Server.evtx --------------------- Default permissions are in place. Current ACL: NT SERVICE\EventLog:(I)(F) NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Administrators:(I)(F) ---------------------
Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_WinServerDNS_V2R3_20251023-172313.ckl
Scan Date: 2026-01-14T12:57:38.179760
Technology Area: Domain Name System
|
||||||||