CUI

USNS MONTFORD POINT - Findings

Back to Ship Export CSV Download POA&M

Showing 7 of 7 findings (filtered) View Documentation Status (90 tracked)

Vuln ID	Severity	Asset	STIG	Title	Status	Doc Status	Assigned To	Actions
V-243506	CAT I	MONT-DC-003	Active Directory Forest Security Technic...	Update access to the directory schema must be rest...		-
Check Text Start a Schema management console. (See supplemental notes.) Select and then right-click on the Active Directory Schema entry in the left pane. Select Permissions. If any of the permissions for the Schema object are not at least as restrictive as those below, this is a finding. The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the Advanced button, selecting the desired entry, and the Edit button. Authenticated Users: Read Special Permissions The Special permissions for Authenticated Users are List and Read type. If detailed permissions include any additional Permissions or Properties this is a finding. System: Full Control Enterprise Read-only Domain Controllers: Replicating Directory Changes Replicating Directory Changes All Replicating Directory Changes In Filtered Set Schema Admins: Read Write Create all child objects Change schema master Manage replication topology Monitor active directory replication Read only replication secret synchronization Reanimate tombstones Replicating Directory Changes Replicating Directory Changes All Replicating Directory Changes In Filtered Set Replication synchronization Update schema cache Special permissions (Special permissions = all except Full, Delete, and Delete subtree when detailed permissions viewed.) Administrators: Manage replication topology Replicating Directory Changes Replicating Directory Changes All Replicating Directory Changes In Filtered Set Replication Synchronization Enterprise Domain Controllers: Manage replication topology Replicating Directory Changes Replicating Directory Changes All Replicating Directory Changes In Filtered Set Replication Synchronization Supplemental Notes: If the Schema management console has not already been configured on the computer, create a console by using the following: The steps for adding the snap-in may vary depending on the Windows version. Register the required DLL module by typing the following at a command line "regsvr32 schmmgmt.dll". Run "mmc.exe" to start a Microsoft Management Console. Select Add/Remove Snap-in from the File menu. From the Available Standalone Snap-ins list, select Active Directory Schema Select the Add button. Select the OK button. When done using the console, select Exit from the File (or Console) menu. Select the No button to the Save console settings... prompt (unless the SA wishes to retain this console). If the console is retained, the recommended name is schmmgmt.msc and the recommended location is the [systemroot]\system32 directory. Fix Text Ensure the access control permissions for the AD Schema object conform to the required permissions as shown below. Authenticated Users: Read Special Permissions The Special permissions for Authenticated Users are List and Read type. If detailed permissions include any additional Permissions or Properties this is a finding. System: Full Control Enterprise Read-only Domain Controllers: Replicating Directory Changes Replicating Directory Changes All Replicating Directory Changes In Filtered Set Schema Admins: Read Write Create all child objects Change schema master Manage replication topology Monitor active directory replication Read only replication secret synchronization Reanimate tombstones Replicating Directory Changes Replicating Directory Changes All Replicating Directory Changes In Filtered Set Replication synchronization Update schema cache Special permissions (Special permissions = all except Full, Delete, and Delete subtree when detailed permissions viewed.) Administrators: Manage replication topology Replicating Directory Changes Replicating Directory Changes All Replicating Directory Changes In Filtered Set Replication Synchronization Enterprise Domain Controllers: Manage replication topology Replicating Directory Changes Replicating Directory Changes All Replicating Directory Changes In Filtered Set Replication Synchronization Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryForest_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: D7B79E8932C30F595C990EF4C4AE2F8DF34DF99C ~~~~~ Schema Permissions: Permissions are set to the default for: Administrators - Replicating Directory Changes All Permissions are set to the default for: Administrators - Replicating Directory Changes In Filtered Set Permissions are set to the default for: Administrators - Manage replication topology Permissions are set to the default for: Administrators - Replicating Directory Changes Permissions are set to the default for: Administrators - Replication Synchronization Permissions are set to the default for: Enterprise Read-only Domain Controllers - Replicating Directory Changes In Filtered Set Permissions are set to the default for: Enterprise Read-only Domain Controllers - Replicating Directory Changes Permissions are set to the default for: Enterprise Read-only Domain Controllers - Replicating Directory Changes All Permissions are set to the default for: Schema Admins - Change schema master Permissions are set to the default for: Schema Admins - Special (except Full, Delete, and Delete subtree) Permissions are set to the default for: Authenticated Users - Read Permissions are set to the default for: Enterprise Domain Controllers - Manage replication topology Permissions are set to the default for: Enterprise Domain Controllers - Replicating Directory Changes All Permissions are set to the default for: Enterprise Domain Controllers - Replicating Directory Changes In Filtered Set Permissions are set to the default for: Enterprise Domain Controllers - Replicating Directory Changes Permissions are set to the default for: Enterprise Domain Controllers - Replication Synchronization Permissions are set to the default for: System - Full Control Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADForest_V3R2_20251023-171845.ckl Scan Date: 2026-01-14T12:57:36.607366 Technology Area: Domain Name System
V-269098	CAT I	MONT-DC-003	Active Directory Forest Security Technic...	Windows Server hosting Active Directory Certificat...		-
Check Text Certificate templates with the following extended key usages AND that allow a requestor to supply the subject name in the request require manual approval. In the AD CS web server properties, select "VulnerableCertTemplate" properties. Verify that "Subject Name" and "Supply in the request" are selected. If "Subject Name" AND "Supply in the request" are selected and if manual approval is not required, this is a finding. If the "Supply in Request" is NOT selected, and the Enroll Permissions for the template have been limited to a select group of users/administrators, this is not a finding. Fix Text In the AD CS web server properties, select "VulnerableCertTemplate" properties and then select "Subject Name" and "Supply in the request". Certificate templates with the following extended key usages must require manual approval in all cases: i. Smart Card Logon (1.3.6.1.4.1.311.20.2.2). ii. Any Purpose EKU (2.5.29.37.0). iii. No EKU set. i.e., this is a (subordinate) CA certificate. Certificate templates with the following extended key usages AND that allow a requestor to supply the subject name in the request must require manual approval: i. Client Authentication (1.3.6.1.5.5.7.3.2). ii. PKINIT Client Authentication (1.3.6.1.5.2.3.4). iii. Supply in request" setting: VulnerableCertTemplate Properties. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADForest_V3R2_20251023-171845.ckl Scan Date: 2026-01-14T12:57:36.607366 Technology Area: Domain Name System
V-269099	CAT I	MONT-DC-003	Active Directory Forest Security Technic...	Windows Server running Active Directory Certificat...		-
Check Text Verify that a site has set aside one or more PAWs for remote management of AD CS. A dedicated AD CS/CA Admin account that is only usable on tier 0 PAW or the ADCS server must be used to manage the certificate authority and approve requests. Review any available site documentation. Verify that any PAW used to manage high-value IT resources of a specific tier are used exclusively for managing high-value IT resources assigned to only one tier. If the site has not set aside one or more PAWs for remote management of AD CS, this is a finding. Fix Text Configure and set aside one or more PAWs for configuration and management of AD CS. For AD, multiple configuration items could enable anonymous access. Set aside one or more PAWs for remote management of high-value IT resources assigned to a specific tier. For example, using the Microsoft Tier 0-2 model, each PAW would be assigned to manage Tier 0, Tier 1, or Tier 2 high-value IT resources. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADForest_V3R2_20251023-171845.ckl Scan Date: 2026-01-14T12:57:36.607366 Technology Area: Domain Name System
V-243502	CAT II	MONT-DC-003	Active Directory Forest Security Technic...	Membership to the Schema Admins group must be limi...		Documented Pending Review
Check Text Open "Active Directory Users and Computers" on a domain controller in the forest root domain. Navigate to the "Users" container. Right-click on "Schema Admins" and select "Properties", and then select the "Members" tab. If any accounts other than the built-in Administrators group are members, verify their necessity with the ISSO. If any accounts are members of the group when schema changes are not being made, this is a finding. Fix Text Limit membership in the Schema Admins group to only those accounts necessary during a schema update. Remove accounts when the updates are complete. Document accounts necessary during schema updates with the ISSO. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryForest_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 909250FAC5A80BC1161A07D6B15B371F54411F1B ~~~~~ ========================= Name: MONTFORD-POINT\SHB_Admin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-500 DistinguishedName: CN=SHB_Admin,CN=Users,DC=MONTFORD-POINT,DC=navy,DC=mil Name: MONTFORD-POINT\d.admin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1104 DistinguishedName: CN=D.Admin,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil Name: MONTFORD-POINT\montford.exchange objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1118 DistinguishedName: CN=Exchange Admin,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil Name: MONTFORD-POINT\MONTFORD-POINT LAN Management objectClass: group objectSID: S-1-5-21-1360995287-4027491577-3040029667-1193 DistinguishedName: CN=MONTFORD-POINT LAN Management,OU=GROUPS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil Name: MONTFORD-POINT\MONTFORD-POINT Techs objectClass: group objectSID: S-1-5-21-1360995287-4027491577-3040029667-1194 DistinguishedName: CN=MONTFORD-POINT Techs,OU=GROUPS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADForest_V3R2_20251023-171845.ckl Scan Date: 2026-01-14T12:57:36.607366 Technology Area: Domain Name System
V-243503	CAT II	MONT-DC-003	Active Directory Forest Security Technic...	Anonymous Access to AD forest data above the rootD...		-
Check Text 1. At the command line prompt enter (on a single line): dsquery * "cn=Directory Service, cn=Windows NT,cn=Services,cn=Configuration,dc=[forest-name]" -scope base -attr * (Where dc=[forest-name] is the fully qualified LDAP name of the root of the domain being reviewed.) Example: The following is an example of the dsquery command for the vcfn.ost.com forest. dsquery * "cn=Directory Service,cn=Windows NT,cn=Services,cn=Configuration, dc=vcfn,dc=ost,dc=com -scope base -attr * 2. If the dsHeuristics attribute is listed, note the assigned value. 3. If the dsHeuristics attribute is defined and has a "2" as the 7th character, then this is a finding. Examples of values that would be a finding as follows: "0000002", "0010002", "0000002000001". (The 7th character controls anonymous access.) Supplementary Notes: Domain controllers have this option disabled by default. However, this check verifies that the option has not been enabled. The dsHeuristics option can be configured with the Windows Support Tools Active Directory Service Interfaces Editor (ADSI Edit) console (adsiedit.msc). Fix Text Disable anonymous access to AD forest data above the rootDSE level. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryForest_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 26BEA1DC84262B8BF520677BDD9DEEBFD409D6A3 ~~~~~ 'dsHeuristics' is not configured. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADForest_V3R2_20251023-171845.ckl Scan Date: 2026-01-14T12:57:36.607366 Technology Area: Domain Name System
V-243504	CAT II	MONT-DC-003	Active Directory Forest Security Technic...	The Windows Time Service on the forest root PDC Em...		Documented Pending Review
Check Text This applies to the domain controller with the PDC Emulator role in forest root domain; it is NA for other domain controllers in the forest. Determine the domain controller with the PDC Emulator role in the forest root domain: Windows 2016 or later: Open "Windows PowerShell". Enter "Get-ADDomain -Identity [Forest Root Domain] \| FT PDCEmulator", where [Forest Root Domain] is the forest root domain name, such as "example.mil". (This can also be entered without the -Identity parameter if running within the forest root domain.) Windows 2016: Open "Active Directory Users and Computers" from a domain controller in or connected to the forest root (available from various menus or run "dsa.msc"). Select "Action" in the menu, then All Tasks >> Operations Masters. Select the "PDC" tab. On the system with the PDC Emulator role, open "Windows PowerShell" or an elevated "Command Prompt" (run as administrator). Enter "W32tm /query /configuration". Under the "NtpClient" section: If the value for "Type" is not "NTP", this is a finding. If the value for "NtpServer" is not an external DOD time source, this is a finding. If an alternate time synchronization tool is used and is not enabled or not configured to a synchronize with an external DOD time source, this is a finding. The US Naval Observatory operates stratum 1 time servers, identified at https://www.cnmoc.usff.navy.mil/Our-Commands/United-States-Naval-Observatory/Precise-Time-Department/Network-Time-Protocol-NTP/. Time synchronization will occur through a hierarchy of time servers down to the local level. Clients and lower-level servers will synchronize with an authorized time server in the hierarchy. Fix Text Configure the forest root PDC Emulator to acquire its time from an external time source. The Windows Time Service can be configured by setting the policy value for Computer Configuration >> Administrative Templates >> System >> Windows Time Service >> Time Providers >> "Configure Windows NTP Client" to "Enabled", and configuring the "NtpServer" field to point to an authorized time server. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryForest_Checks) found this to be OPEN on 10/23/2025 ResultHash: 88A87293C2622EEB484E11DDD7762929A04734DC ~~~~~ DomainRole: Primary Domain Controller NtpClient (Local) Type: NT5DS (Policy) [expected 'NTP'] Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADForest_V3R2_20251023-171845.ckl Scan Date: 2026-01-14T12:57:36.607366 Technology Area: Domain Name System
V-243505	CAT III	MONT-DC-003	Active Directory Forest Security Technic...	Changes to the AD schema must be subject to a docu...		Documented Pending Review
Check Text 1. Interview the ISSO. 2. Obtain a copy of the site's configuration management procedures documentation. 3. Verify that there is a local policy that requires changes to the directory schema to be processed through a configuration management process. This applies to directory schema changes whether implemented in a database or other types of files. For AD, this refers to changes to the AD schema. 4. If there is no policy that requires changes to the directory schema to be processed through a configuration management process, then this is a finding. Fix Text Document and implement a policy to ensure that changes to the AD schema are subject to a configuration management process. Comments CRQ process, do we need documentation? Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADForest_V3R2_20251023-171845.ckl Scan Date: 2026-01-14T12:57:36.607366 Technology Area: Domain Name System

CUI