| Vuln ID | Severity | Asset | STIG | Title | Status | Doc Status | Assigned To | Actions |
|---|---|---|---|---|---|---|---|---|
| V-259368 | CAT II | MONT-DC-003 | Microsoft Windows Server Domain Name Sys... | The Windows DNS Server key file must be owned by t... | - | |||
Check TextAccess Services on the Windows DNS Server and locate the DNS Server Service. Determine the account under which the DNS Server Service is running. Access Windows Explorer. Navigate to the following location: %ALLUSERSPROFILE%\Microsoft\Crypto Note: If the folder above does not exist, this check is not applicable. Right-click on each subfolder, choose "Properties", click the "Security" tab, and click the "Advanced" button. Verify the Owner on the folder, subfolders, and files is the account under which the DNS Server Service is running. If any other user or group is listed as OWNER of the %ALLUSERSPROFILE%\Microsoft\Crypto folder, subfolders, and files, this is a finding. Fix TextAccess Windows Explorer. Navigate to the following location: %ALLUSERSPROFILE%\Microsoft\Crypto Right-click on each subfolder, choose "Properties", click the "Security" tab, and click the "Advanced" button. Click "Change" next to the listed Owner and change to be the account under which the DNS Server Service is running. Finding DetailsEvaluate-STIG 1.2507.5 (Scan-WindowsServerDNS_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 29E483B2F45F4551F92EA09FA9363AA22AB35A11 ~~~~~ DNS Service Account: LocalSystem 'C:\ProgramData\Microsoft\Crypto' and all subfolders and files are owned by the DNS service account.
Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_WinServerDNS_V2R3_20251023-172313.ckl
Scan Date: 2026-01-14T12:57:38.179760
Technology Area: Domain Name System
|
||||||||