USNS MONTFORD POINT - Findings

Showing 36 of 36 findings (filtered) View Documentation Status (90 tracked)

Vuln ID	Severity	Asset	STIG	Title	Doc Status
V-243466	CAT I	MONT-DC-003	Active Directory Domain Security Technic...	Membership to the Enterprise Admins group must be ...	Documented Pending Review
Check Text Review the Enterprise Admins group in Active Directory Users and Computers. Any accounts that are members of the Enterprise Admins group must be documented with the IAO. Each Enterprise Administrator must have a separate unique account specifically for managing the Active Directory forest. If any account listed in the Enterprise Admins group is a member of other administrator groups including the Domain Admins group, domain member server administrators groups, or domain workstation administrators groups, this is a finding. Fix Text Create the necessary documentation that identifies the members of the Enterprise Admins group. Ensure that each member has a separate unique account that can only be used to manage the Active Directory Forest. Remove any Enterprise Admin accounts from other administrator groups. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be OPEN on 10/23/2025 ResultHash: 1852EDAFFD0549867EBD2E419B98256759732803 ~~~~~ Members of 'Enterprise Admins' ========================= Name: MONTFORD-POINT\Alexandra.M.Perl objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1160 DistinguishedName: CN=Perl\, Alexandra M.\, CTR,OU=USERS,OU=MONTFORD-POINT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: MONTFORD-POINT ALL HANDS MONTFORD-POINT RADIO MONTFORD-POINT LAN Management MONTFORD-POINT EO Name: MONTFORD-POINT\altucker.iaadmin [FINDING] objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1224 DistinguishedName: CN=Tucker\, Adam L.\, CTR,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Domain Administrator Group Domain Admins [FINDING] Remote Desktop Users Name: MONTFORD-POINT\amperl.admin [FINDING] objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1638 DistinguishedName: CN=ADMIN\, AMPerl,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: MONTFORD-POINT LAN Management Member Server Administrator Group Domain Administrator Group Domain Admins [FINDING] Remote Management Users Name: MONTFORD-POINT\d.admin [FINDING] objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1104 DistinguishedName: CN=D.Admin,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Member Server Administrator Group Domain Administrator Group Domain Admins [FINDING] Schema Admins [FINDING] Remote Management Users Remote Desktop Users Name: MONTFORD-POINT\jrsanders.iaadmin [FINDING] objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1253 DistinguishedName: CN=Sanders\, James R.\, CTR,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Member Server Administrator Group Domain Administrator Group Domain Admins [FINDING] Remote Management Users Remote Desktop Users Name: MONTFORD-POINT\MONT-EM-Admin [FINDING] objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1157 DistinguishedName: CN=MONT-EM-Admin,OU=SERVICE ACCOUNTS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Domain Administrator Group Domain Admins [FINDING] Remote Desktop Users Administrators [FINDING] Name: MONTFORD-POINT\montford.exchange [FINDING] objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1118 DistinguishedName: CN=Exchange Admin,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Organization Management Schema Admins [FINDING] Administrators [FINDING] Name: MONTFORD-POINT\SHB_Admin [FINDING] objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-500 DistinguishedName: CN=SHB_Admin,CN=Users,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Group Policy Creator Owners Domain Admins [FINDING] Schema Admins [FINDING] Administrators [FINDING] Name: MONTFORD-POINT\Thomas.L.Jones objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1176 DistinguishedName: CN=Jones\, Thomas L.\, CTR,OU=USERS,OU=MONTFORD-POINT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: MONTFORD-POINT ENG MONTFORD-POINT ALL HANDS MONTFORD-POINT RADIO MONTFORD-POINT LAN Management MONTFORD-POINT EO Name: MONTFORD-POINT\TLJones.Admin [FINDING] objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1250 DistinguishedName: CN=Jones\, Thomas L.\, Admin,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: MONTFORD-POINT LAN Management Member Server Administrator Group Domain Administrator Group Domain Admins [FINDING] Remote Management Users Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243467	CAT I	MONT-DC-003	Active Directory Domain Security Technic...	Membership to the Domain Admins group must be rest...	Documented Pending Review
Check Text Review the Domain Admins group in Active Directory Users and Computers. Any accounts that are members of the Domain Admins group must be documented with the IAO. Each Domain Administrator must have a separate unique account specifically for managing the Active Directory domain and domain controllers. If any account listed in the Domain Admins group is a member of other administrator groups including the Enterprise Admins group, domain member server administrators groups, or domain workstation administrators groups, this is a finding. Fix Text Create the necessary documentation that identifies the members of the Domain Admins group. Ensure that each member has a separate unique account that can only be used to manage the Active Directory domain and domain controllers. Remove any Domain Admin accounts from other administrator groups. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be OPEN on 10/23/2025 ResultHash: 7225AB9272CF53F1FFEA5139423A0233F41DA652 ~~~~~ Members of 'Domain Admins' ========================= Name: MONTFORD-POINT\adsmith.iaadmin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1249 DistinguishedName: CN=Smith\, Alexander D.\, CTR,OU=USERS,OU=MONTFORD-POINT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Name: MONTFORD-POINT\altucker.iaadmin [FINDING] objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1224 DistinguishedName: CN=Tucker\, Adam L.\, CTR,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Domain Administrator Group Enterprise Admins [FINDING] Remote Desktop Users Name: MONTFORD-POINT\amperl.admin [FINDING] objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1638 DistinguishedName: CN=ADMIN\, AMPerl,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: MONTFORD-POINT LAN Management Member Server Administrator Group Domain Administrator Group Enterprise Admins [FINDING] Remote Management Users Name: MONTFORD-POINT\ANOC.FIM objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1203 DistinguishedName: CN=FIM\, ANOC,CN=Users,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Organization Management Domain Administrator Group Name: MONTFORD-POINT\d.admin [FINDING] objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1104 DistinguishedName: CN=D.Admin,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Member Server Administrator Group Domain Administrator Group Enterprise Admins [FINDING] Schema Admins [FINDING] Remote Management Users Remote Desktop Users Name: MONTFORD-POINT\iwgonzalez.iaadmin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1242 DistinguishedName: CN=Gonzalez\, Ian W.\, CTR,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Name: MONTFORD-POINT\jrsanders.iaadmin [FINDING] objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1253 DistinguishedName: CN=Sanders\, James R.\, CTR,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Member Server Administrator Group Domain Administrator Group Enterprise Admins [FINDING] Remote Management Users Remote Desktop Users Name: MONTFORD-POINT\jtbegarek.iaadmin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1212 DistinguishedName: CN=IA ADMIN\, JTBegarek,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Organization Management Member Server Administrator Group Domain Administrator Group Domain Users Name: MONTFORD-POINT\MONT-EM-Admin [FINDING] objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1157 DistinguishedName: CN=MONT-EM-Admin,OU=SERVICE ACCOUNTS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Domain Administrator Group Enterprise Admins [FINDING] Remote Desktop Users Administrators [FINDING] Name: MONTFORD-POINT\montford.exchange [FINDING] objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1118 DistinguishedName: CN=Exchange Admin,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Organization Management Enterprise Admins [FINDING] Schema Admins [FINDING] Administrators [FINDING] Name: MONTFORD-POINT\RDRivera.IAADMIN objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1213 DistinguishedName: CN=Rivera\, RJ,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Name: MONTFORD-POINT\scan.admin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1192 DistinguishedName: CN=Scan Admin,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Workstation Administrator Group Member Server Administrator Group Remote Desktop Users Name: MONTFORD-POINT\SHB_Admin [FINDING] objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-500 DistinguishedName: CN=SHB_Admin,CN=Users,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Group Policy Creator Owners Enterprise Admins [FINDING] Schema Admins [FINDING] Administrators [FINDING] Name: MONTFORD-POINT\tagavrilovic.iaadmin [FINDING] objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1231 DistinguishedName: CN=Gavrilovic\, Tyler A.\, CTR,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: Remote Desktop Users Administrators [FINDING] Name: MONTFORD-POINT\TLJones.Admin [FINDING] objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1250 DistinguishedName: CN=Jones\, Thomas L.\, Admin,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil OtherMemberOf: MONTFORD-POINT LAN Management Member Server Administrator Group Domain Administrator Group Enterprise Admins [FINDING] Remote Management Users Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243470	CAT I	MONT-DC-003	Active Directory Domain Security Technic...	Delegation of privileged accounts must be prohibit...	Documented Pending Review
Check Text Review the properties of all privileged accounts in Active Directory Users and Computers. Under the Account tab, verify "Account is sensitive and cannot be delegated" is selected in the Account Options section. If delegation is not prohibited for any privileged account, this is a finding. Fix Text Open Active Directory Users and Computers. View the properties of all privileged accounts. Under the Account tab, select "Account is sensitive and cannot be delegated" in the Account Options section. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243482	CAT I	MONT-DC-003	Active Directory Domain Security Technic...	Interconnections between DoD directory services of...	-
Check Text 1. Refer to the list of identified trusts and the trust documentation provided by the site representative. (Obtained in V-8530) 2. For each of the identified trusts between DoD organizations, compare the classification level (unclassified, confidential, secret, and top secret) of the domain being reviewed with the classification level of the other trust party as noted in the documentation. 3. If the classification level of the domain being reviewed is different than the classification level of any of the entities for which a trust relationship is defined, then this is a finding. Fix Text Delete the trust relationship that is defined between entities with resources at different DoD classification levels. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 48551156A5DDF0637531025EE03B12E7D7F6DBEE ~~~~~ No trusts are configured so this requirement is NA. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243483	CAT I	MONT-DC-003	Active Directory Domain Security Technic...	A controlled interface must have interconnections ...	-
Check Text 1. Refer to the list of identified trusts obtained in a previous check (V8530). 2. For each of the identified trusts, determine if the other trust party is a non-DoD entity. For example, if the fully qualified domain name of the other party does not end in ".mil", the other party is probably not a DoD entity. 3. Review the local documentation approving the external network connection and documentation indicating explicit approval of the trust by the DAA. 4. The external network connection documentation is maintained by the IAO\NSO for compliance with the Network Infrastructure STIG. 5. If any trust is defined with a non-DoD system and there is no documentation indicating approval of the external network connection and explicit DAA approval of the trust, then this is a finding. Fix Text Obtain DAA approval and document external, forest, or realm trust relationship. Or obtain documentation of the network connection approval and explicit trust approval by the DAA. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 48551156A5DDF0637531025EE03B12E7D7F6DBEE ~~~~~ No trusts are configured so this requirement is NA. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243468	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Administrators must have separate accounts specifi...	Documented Pending Review
Check Text Review the membership groups in Active Directory Users and Computers. Membership groups must be designated at the domain level specifically for domain member server administrators. Domain member server administrator groups and any accounts that are members of the groups must be documented with the IAO. Each member server administrator must have a separate unique account specifically for managing member servers. If any account listed in a domain member server administrator group is a member of other administrator groups including the Enterprise Admins group, the Domain Admins group, or domain workstation administrator groups, this is a finding. Fix Text Create the necessary documentation that identifies the members of domain member server administrator groups. Ensure that each member has a separate unique account that can only be used to manage domain member servers. Remove any domain member server accounts from other administrator groups. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243469	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Administrators must have separate accounts specifi...	Documented Pending Review
Check Text Review the membership groups in Active Directory Users and Computers. Membership groups must be designated at the domain level specifically for domain workstation administrators. Domain workstation administrator groups and any accounts that are members of the groups must be documented with the IAO. Each domain workstation administrator must have a separate unique account specifically for managing domain workstations. If any account listed in a domain workstation administrator group is a member of other administrator groups including the Enterprise Admins group, the Domain Admins group, or domain member server administrator groups, this is a finding. Fix Text Create the necessary documentation that identifies the members of domain workstation administrator groups. Ensure that each member has a separate unique account that can only be used to manage domain workstations. Remove any domain workstation administrator accounts from other administrator groups. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243471	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Local administrator accounts on domain systems mus...	-
Check Text Verify local administrator accounts on domain systems are using unique passwords. If local administrator accounts on domain systems are sharing a password, this is a finding. It is recommended to use Microsoft's Local Administrator Password Solution (LAPS), which provides an automated solution for maintaining and regularly changing a local administrator password for domain-joined systems. LAPS can manage a single local administrator account. The default is the built-in administrator account; however, it can be configured to manage an administrator account of a different name. If additional local administrator accounts exist across systems, the organization must have a process to require unique passwords on each system for the additional accounts. The authorizing official (AO) may approve other automated solutions that provide this capability. Open "Windows PowerShell". Get-ADComputer -Filter * -Properties msLAPS-EncryptedPassword \| Where-Object { $_."msLAPS-EncryptedPassword" -eq $null } \| Select-Object Name The newer "Windows LAPS" function stores the LAPS password in the object attribute "msLAPS-EncryptedPassword" as long as the "encrypted" option was selected when setting up the LAPS GPO settings. This will check that location. If "encrypted" wasn't enabled when setting up LAPS, then adjust the search command to be "msLAPS-Password" instead. Review the returned list for validity. If any active/deployed Windows systems that are not managed by another process to ensure unique passwords for local administrator accounts are listed, this is a finding. If the query fails, the organization must demonstrate that passwords for local administrator accounts are properly managed to ensure unique passwords for each. If not, this is a finding. Fix Text Set unique passwords for all local administrator accounts on domain systems. It is highly recommended to use Microsoft's LAPS, which provides an automated solution for maintaining and regularly changing a local administrator password for domain-joined systems. If additional local administrator accounts exist across systems, the organization must have a process to require unique passwords on each system for the additional accounts. The AO may approve other automated solutions that provide this capability. See Microsoft Security Advisory 3062591 for additional information and download of LAPS. https://www.microsoft.com/en-us/download/details.aspx?id=46899 Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243472	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Separate smart cards must be used for Enterprise A...	Documented Pending Review
Check Text Verify separate smart cards are used for EA and DA accounts from smart cards used for other accounts. EA and DA accounts may be on the same smart card but must be separate from any other accounts. If separate smart cards for EA and DA accounts from other accounts are not used, this is a finding. Fix Text Use separate smart cards for EA and DA accounts from smart cards used for other accounts. EA and DA accounts may be on the same smart card but must be separate from any other accounts. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243473	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Separate domain accounts must be used to manage pu...	-
Check Text If the domain does not have any public facing servers, this is NA. Review the local Administrators group on public facing servers. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group. For public facing servers, the Domain Admins group must be replaced by a domain member server administrator group whose members are different from any used to manage internal servers. If any domain accounts or groups used to manage internal servers are members of the local administrators group, this is a finding. Fix Text If the domain does not have any public facing servers, this is NA. Configure the system to include only administrator groups or accounts that are responsible for the system in the local Administrators group. For public facing servers, replace the Domain Admins group with a domain member server administrator group whose members are different from any used to manage internal servers. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: B096C379B49B26BC871A78CA4A53DDF65C083469 ~~~~~ Members of 'Administrators' ========================= Name: MONTFORD-POINT\SHB_Admin objectClass: User objectSID: S-1-5-21-1360995287-4027491577-3040029667-500 Name: MONTFORD-POINT\DOD_Admin objectClass: User objectSID: S-1-5-21-1360995287-4027491577-3040029667-1000 Name: MONTFORD-POINT\Enterprise Admins objectClass: Group objectSID: S-1-5-21-1360995287-4027491577-3040029667-519 Name: MONTFORD-POINT\Domain Admins objectClass: Group objectSID: S-1-5-21-1360995287-4027491577-3040029667-512 Name: MONTFORD-POINT\montford.exchange objectClass: User objectSID: S-1-5-21-1360995287-4027491577-3040029667-1118 Name: MONTFORD-POINT\MONT-EM-Admin objectClass: User objectSID: S-1-5-21-1360995287-4027491577-3040029667-1157 Name: MONTFORD-POINT\Montford.backup objectClass: User objectSID: S-1-5-21-1360995287-4027491577-3040029667-1614 Name: MONTFORD-POINT\tagavrilovic.iaadmin objectClass: User objectSID: S-1-5-21-1360995287-4027491577-3040029667-1231 Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243475	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Domain controllers must be blocked from Internet a...	Documented Pending Review
Check Text Verify domain controllers are blocked from Internet access. Various methods may be employed to accomplish this, such as restrictions at boundary firewalls, through proxy services, host based firewalls or IPsec. Review the Internet access restrictions with the administrator. If Internet access is not prevented, this is a finding. If a critical function requires Internet access, this must be documented and approved by the organization. Fix Text Block domain controllers from internet access. This can be accomplished with various methods, such as restrictions at boundary firewalls, proxy services, host based firewalls, or IPsec. If a critical function requires Internet access, this must be documented and approved by the organization. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243476	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	All accounts, privileged and unprivileged, that re...	-
Check Text Windows Server 2016 with a domain functional level of Windows Server 2016: Open "Active Directory Administrative Center". Right-click on the domain name and select "Properties". If the "Domain functional level:" is not "Windows Server 2016", another method must be used to reset the NT hashes. See below for other options. If the "Domain functional level:" is "Windows Server 2016" and "Enable rolling of expiring NTLM secrets during sign on, for users who are required to use Microsoft Passport or smart card for interactive sign on" is not checked, this is a finding. Active Directory domains with a domain functional level below Windows Server 2016: Verify the organization rotates the NT hash for smart card-enforced accounts every 60 days. This can be accomplished with the use of scripts. DOD PKI-PKE has provided a script under PKI and PKE Tools at https://cyber.mil/pki-pke/tools-configuration-files/. Refer to the User Guide for additional information. NSA has also provided a PowerShell script with Pass-the-Hash guidance at https://github.com/nsacyber/Pass-the-Hash-Guidance. Running the "Invoke-SmartcardHashRefresh" cmdlet in the "PtHTools" module will trigger a change of the underlying NT hash. Refer to the site for additional information. Manually rolling the NT hash requires disabling and reenabling the "Smart Card required for interactive logon" option for each smart card-enforced account, which is not practical for large groups of users. If NT hashes for smart card-enforced accounts are not rotated every 60 days, this is a finding. Fix Text Windows Server 2016 with domain functional levels of Windows Server 2016: Open "Active Directory Administrative Center". Right-click on the domain name and select "Properties". Select "Enable rolling of expiring NTLM secrets during sign on, for users who are required to use Microsoft Passport or smart card for interactive sign on". Active Directory domains not at a Windows Server 2016 domain functional level: Rotate the NT hash for smart card-enforced accounts every 60 days. This can be accomplished with the use of scripts. DOD PKI-PKE has provided a script under PKI and PKE Tools at https://cyber.mil/pki-pke/tools-configuration-files/. Refer to the User Guide for additional information. NSA has also provided a PowerShell script with Pass-the-Hash guidance at https://github.com/nsacyber/Pass-the-Hash-Guidance. Running the "Invoke-SmartcardHashRefresh" cmdlet in the "PtHTools" module will trigger a change of the underlying NT hash. Refer to the site for additional information. Manually rolling the NT hash requires disabling and reenabling the "Smart Card required for interactive logon" option for each smart card-enforced account, which is not practical for large groups of users. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: B9751811B5587DC898185A44CA352F1B0D09ABDF ~~~~~ Domain Level: Windows2016Domain Rolling of expiring NTLM Secrets: True Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243477	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	User accounts with domain level administrative pri...	Documented Pending Review
Check Text Open "Windows PowerShell". Enter "Get-ADDomain \| FL DomainMode" to determine the domain functional level. Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). Compare membership of the Protected Users group to membership of the following groups. By default, the groups are under the node referenced; however, it is possible to move those under "Users" to another location. Enterprise Admins (Users node) Domain Admins (Users node) Schema Admins (Users node) Administrators (Builtin node) Account Operators (Builtin node) Backup Operators (Builtin node) It is recommended that one account be excluded to ensure availability if there are issues with Kerberos. Excluding the account left out for availability, if all user accounts from the local domain that are members of the domain level groups above are not also members of the Protected Users group, this is a finding. (User accounts is referring to accounts for personnel, not service accounts.) Fix Text Add user accounts from the local domain that are members of the domain level administrative groups listed below to the Protected Users group. One account may excluded to ensure availability if there are issues with Kerberos. Enterprise Admins (Users node) Domain Admins (Users node) Schema Admins (Users node) Administrators (Builtin node) Account Operators (Builtin node) Backup Operators (Builtin node) The use of the Protected Users group should be thoroughly tested before fully implementing. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 314B6E5CF1F8B145CB057FCD5D58C475C8C3C370 ~~~~~ Accounts are missing from 'Protected Users'. Only service accounts and one (1) user account with domain level administrative privileges may be excluded. Please confirm for compliance. Users Missing From 'Protected Users' Group ============================================ Name: MONTFORD-POINT\adsmith.iaadmin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1249 DistinguishedName: CN=Smith\, Alexander D.\, CTR,OU=USERS,OU=MONTFORD-POINT,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators, Domain Admins Name: MONTFORD-POINT\Alexandra.M.Perl objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1160 DistinguishedName: CN=Perl\, Alexandra M.\, CTR,OU=USERS,OU=MONTFORD-POINT,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators, Enterprise Admins, Schema Admins Name: MONTFORD-POINT\altucker.iaadmin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1224 DistinguishedName: CN=Tucker\, Adam L.\, CTR,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators, Domain Admins, Enterprise Admins Name: MONTFORD-POINT\amperl.admin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1638 DistinguishedName: CN=ADMIN\, AMPerl,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators, Domain Admins, Enterprise Admins, Schema Admins Name: MONTFORD-POINT\ANOC.FIM objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1203 DistinguishedName: CN=FIM\, ANOC,CN=Users,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators, Domain Admins Name: MONTFORD-POINT\d.admin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1104 DistinguishedName: CN=D.Admin,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators, Domain Admins, Enterprise Admins, Schema Admins Name: MONTFORD-POINT\DOD_Admin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1000 DistinguishedName: CN=DOD_Admin,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators Name: MONTFORD-POINT\iwgonzalez.iaadmin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1242 DistinguishedName: CN=Gonzalez\, Ian W.\, CTR,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators, Domain Admins Name: MONTFORD-POINT\jrsanders.iaadmin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1253 DistinguishedName: CN=Sanders\, James R.\, CTR,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators, Domain Admins, Enterprise Admins Name: MONTFORD-POINT\jtbegarek.iaadmin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1212 DistinguishedName: CN=IA ADMIN\, JTBegarek,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators, Domain Admins Name: MONTFORD-POINT\MONT-EM-Admin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1157 DistinguishedName: CN=MONT-EM-Admin,OU=SERVICE ACCOUNTS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators, Domain Admins, Enterprise Admins Name: MONTFORD-POINT\Montford.backup objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1614 DistinguishedName: CN=Backup,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators Name: MONTFORD-POINT\montford.exchange objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1118 DistinguishedName: CN=Exchange Admin,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators, Domain Admins, Enterprise Admins, Schema Admins Name: MONTFORD-POINT\RDRivera.IAADMIN objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1213 DistinguishedName: CN=Rivera\, RJ,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators, Domain Admins Name: MONTFORD-POINT\scan.admin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1192 DistinguishedName: CN=Scan Admin,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators, Domain Admins Name: MONTFORD-POINT\SHB_Admin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-500 DistinguishedName: CN=SHB_Admin,CN=Users,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators, Domain Admins, Enterprise Admins, Schema Admins Name: MONTFORD-POINT\tagavrilovic.iaadmin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1231 DistinguishedName: CN=Gavrilovic\, Tyler A.\, CTR,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators, Domain Admins Name: MONTFORD-POINT\Thomas.L.Jones objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1176 DistinguishedName: CN=Jones\, Thomas L.\, CTR,OU=USERS,OU=MONTFORD-POINT,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators, Enterprise Admins, Schema Admins Name: MONTFORD-POINT\TLJones.Admin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-1250 DistinguishedName: CN=Jones\, Thomas L.\, Admin,OU=USERS,OU=MONTFORD-POINT SUPPORT,DC=MONTFORD-POINT,DC=navy,DC=mil MemberOf: Administrators, Domain Admins, Enterprise Admins, Schema Admins Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243478	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Domain-joined systems (excluding domain controller...	-
Check Text Open "Windows PowerShell" on a domain controller. Enter "Get-ADComputer -Filter {(TrustedForDelegation -eq $True) -and (PrimaryGroupID -eq 515)} -Properties TrustedForDelegation, TrustedToAuthForDelegation, ServicePrincipalName, Description, PrimaryGroupID". If any computers are returned, this is a finding. (TrustedForDelegation equaling True indicates unconstrained delegation.) PrimaryGroupID 515 = Domain computers (excludes DCs) TrustedForDelegation = Unconstrained Delegation TrustedToAuthForDelegation = Constrained delegation ServicePrincipalName = Service Names Description = Computer Description Fix Text Remove unconstrained delegation from computers in the domain. Select "Properties" for the computer object. Select the "Delegation" tab. De-select "Trust this computer for delegation to any service (Kerberos only)" Configured constrained delegation for specific services where required. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 55740C7819F0A0F534B0C85122BCAD1EB9746BE4 ~~~~~ No computers are Trusted for Delegation and have a Primary Group ID of '515' Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243479	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	The Directory Service Restore Mode (DSRM) password...	Documented Pending Review
Check Text Verify the DSRM password for each DC is changed at least annually. If logs are retained locally for a sufficient amount of time to capture the log event, the following command will indicate the password reset: PS C:\> Get-WinEvent -FilterHashtable @{Logname='Security'; ID=4794} \| Format-Table -Property TimeCreated, Message TimeCreated Message ----------- ------- 10/29/2025 4:47:12 PM An attempt was made to set the Directory Services Restore Mode... If logs are not available, review the site processes around DSRM password reset to determine compliance. If DSRM passwords are not changed for each DC in the domain at least annually, this is a finding. Fix Text Change the DSRM passwords on each DC at least annually with the following commands: C:\> ntdsutil C:\Windows\system32\ntdsutil.exe: Set DSRM Password Reset DSRM Administrator Password: Reset Password on server <servername> Follow prompts to reset the password. Comments Possibly in 5239? Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243480	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	The domain functional level must be at a Windows S...	-
Check Text Open "Active Directory Domains and Trusts" (run "domain.msc") or "Active Directory Users and Computers" (run "dsa.msc"). Right-click in the left pane on the name of the Domain being reviewed. Select "Raise domain functional level..." The current domain functional level will be displayed (as well as the option to raise the domain functional level). Select "Cancel" to exit. Alternately, using PowerShell (Windows Server 2016): Select "Active Directory Module for Windows PowerShell", available in Administrative Tools or the Start Screen. Run "Get-ADDomain". View the value for "DomainMode:" If the domain functional level is not Windows Server 2016, this is a finding. Using the highest domain functional level supported by the domain controllers is recommended. Fix Text Raise the domain functional level to Windows Server 2016. Using the highest domain functional level supported by the domain controllers is recommended. Raising the domain functional level needs to be carefully planned and implemented. This prevents the addition of domain controllers to the domain using Windows versions prior to the current domain functional level. Refer to Microsoft documentation for the process and requirements of raising the domain functional level. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 7046F3346ADC27A5DC94A4619E48DF67887115E4 ~~~~~ Domain Level: Windows2016Domain Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243481	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Access to need-to-know information must be restric...	-
Check Text 1. Before performing this check, perform V-243494, which validates the trusts within the documentation are current within AD. 2. Obtain documentation of the site's approved trusts from the site representative. 3. For each of the identified trusts, verify the documentation includes a justification or explanation of the need-to-know basis of the trust. 4. If the need for the trust is not documented, this is a finding. Fix Text Delete the unneeded trust relationship or document the access requirement or mission need for the trust. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4B26CE40A23C1A3876E1E179534E4E0EC111E8DA ~~~~~ No trusts are configured. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243484	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Security identifiers (SIDs) must be configured to ...	-
Check Text Open "Active Directory Domains and Trusts". (Available from various menus or run "domain.msc".) Right-click the domain in the left pane and select "Properties". Select the "Trusts" tab. Note any existing trusts and the type. If no trusts exist, this is NA. Access a command line and run the following command on the trusting domain: "netdom trust <trusting domain> /d:<trusted domain> /quarantine" If the result does not specify the following, this is a finding. "SID filtering is enabled for this trust. Only SIDs from the trusted domain will be accepted for authorization data returned during authentication. SIDs from other domains will be removed." If the trust type is Forest, run the following command on the trusting domain: "netdom trust <trusting domain> /d:<trusted domain> /enablesidhistory" If the result does not specify "SID history is disabled for this trust", this is a finding. Fix Text Ensure SID filtering is enabled on all external trusts. You can enable SID filtering only from the trusting side of the trust. Enter the following line from a command line: netdom trust <TrustingDomainName> /d:<TrustedDomainName> /quarantine:Yes /usero:<DomainAdministratorAcct> /passwordo:<DomainAdminPwd> Ensure SID history is disabled for all forest trusts. You can disable SID history only from the trusting side of the trust. Enter the following line from a command line: netdom trust <TrustingDomainName> /d:<TrustedDomainName> /enablesidhistory:No /usero:<DomainAdministratorAcct> /passwordo:<DomainAdminPwd> Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 8AD1942BAC2D1AFD7EFD3D0B16A6E76B5300CD0B ~~~~~ No 'External' or 'Forest' trusts are configured so this requirement is NA. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243485	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Selective Authentication must be enabled on outgoi...	-
Check Text Open "Active Directory Domains and Trusts". (Available from various menus or run "domain.msc".) Right click the domain name in the left pane and select "Properties". Select the "Trusts" tab. For each outgoing forest trust, right-click the trust item and select "Properties". Select the "Authentication" tab. If the "Selective Authentication" option is not selected on every outgoing forest trust, this is a finding. Fix Text Enable Selective Authentication on outgoing forest trust. Open "Active Directory Domains and Trusts". (Available from various menus or run "domain.msc".) Right click the domain name in the left pane and select "Properties". Select the "Trusts" tab. For each outgoing forest trust, right-click the trust item and select "Properties". Select the "Authentication" tab. Select the "Selective Authentication" option. (It may be necessary to configure the "Allowed to Authenticate" permission on resources in the trusting domain.) Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 48551156A5DDF0637531025EE03B12E7D7F6DBEE ~~~~~ No trusts are configured so this requirement is NA. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243486	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	The Anonymous Logon and Everyone groups must not b...	-
Check Text Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). Expand the domain being reviewed in the left pane and select the "Builtin" container. Double-click on the "Pre-Windows 2000 Compatible Access" group in the right pane. Select the "Members" tab. If the "Anonymous Logon" or "Everyone" groups are members, this is a finding. (By default, these groups are not included in current Windows versions.) Fix Text Ensure the "Anonymous Logon" and "Everyone" groups are not members of the "Pre-Windows 2000 Compatible Access group". (By default, these groups are not included in current Windows versions.) Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc"). Expand the domain being reviewed in the left pane and select the "Builtin" container. Double-click on the "Pre-Windows 2000 Compatible Access" group in the right pane. Select the "Members" tab. If the "Anonymous Logon" or "Everyone" groups are members, select each and click "Remove". Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 0F5A15D869BBF06C2EB5A9E95A87ED62D87DAB4F ~~~~~ Both 'Anonymous Logon' and 'Everyone' are not members of 'Pre-Windows 2000 Compatible Access'. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243487	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Membership in the Group Policy Creator Owners and ...	Documented Pending Review
Check Text Start "Active Directory Users and Computers" (Available from various menus or run "dsa.msc"). Review the membership of the "Incoming Forest Trust Builders" group. Navigate to the "Built-in" container. Right-click on the "Incoming Forest Trust Builders", select "Properties" and then the "Members" tab. If any accounts are not documented as necessary with the ISSO, this is a finding. Review the membership of the "Group Policy Creator Owner" group. Navigate to the "Users" container. Right-click on the "Group Policy Creator Owner", select "Properties" and then the "Members" tab. If any accounts are not documented as necessary with the ISSO, this is a finding. It is possible to move some system-defined groups from their default locations. If a group is not in the location noted, review other containers to locate. Fix Text Document membership of the Group Policy Creator Owners and Incoming Forest Trust Builders groups. Remove any accounts that do not require the privileges these groups assign. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: FC9B7A301E5B2EB58970D10864AFD58C1C7460A2 ~~~~~ No Users are in the 'Incoming Forest Trust Builders' Group Members of 'Group Policy Creator Owners' ========================= Name: MONTFORD-POINT\SHB_Admin objectClass: user objectSID: S-1-5-21-1360995287-4027491577-3040029667-500 DistinguishedName: CN=SHB_Admin,CN=Users,DC=MONTFORD-POINT,DC=navy,DC=mil Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243489	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Read-only Domain Controller (RODC) architecture an...	-
Check Text 1. Verify that the site has applied the Network Infrastucture STIG to configure the VPN and IPSec. 2. Verify that IPSec and other communications and security configurations for the management and replication of the RODC will be managed by use of the minimum required Group Policy Objects (GPOs). 3. Include an inspection of the RODC server in the DMZ when inspection for least privilege. 4. Verify that required patches and compatibility packs are installed if RODC is used with Windows 2003 (or earlier) clients. 5. If RODC server and configuration does not comply with requirements, then this is a finding. Fix Text 1. Ensure compliance with VPN and IPSec requirements in the Network Insfrastucture STIG. 2. Ensure IPSec and other communications and security configurations for the management and replication of the RODC uses the minimum required Group Policy Objects (GPOs) to provide the required functionality. 3. Replicate only the information needed to provide the functionality required. If full replication of all directory data is not needed, then replicated selective ID and authentication information as needed to the RODC. 4. Include an inspection of the RODC server in the DMZ when inspection for least privilege. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: CE99C7BC2F5744C53889CBD4D51FF39B797836D0 ~~~~~ No read-only domain controllers (RODC) exist in the domain. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243490	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Usage of administrative accounts must be monitored...	-
Check Text Verify account usage events for administrative accounts are being monitored. This includes events related to approved administrative accounts as well as accounts being added to privileged groups such as Administrators, Domain and Enterprise Admins and other organization defined administrative groups. Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools. Monitor for the events listed below, at minimum. If these events are not monitored, this is a finding. Account Lockouts (Subcategory: User Account Management) 4740 - A user account is locked out. User Added to Privileged Group (Subcategory: Security Group Management) 4728 - A member was added to a security-enabled global group. 4732 - A member was added to a security-enabled local group. 4756 - A member was added to a security-enabled universal group. Successful User Account Login (Subcategory: Logon) 4624 - An account was successfully logged on. Failed User Account Login (Subcategory: Logon) 4625 - An account failed to log on. Account Login with Explicit Credentials (Subcategory: Logon) 4648 - A logon was attempted using explicit credentials. Fix Text Monitor account usage events for administrative accounts. This includes events related to approved administrative accounts as well as accounts being added to privileged groups such as Administrators, Domain and Enterprise Admins and other organization defined administrative groups. Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools. Monitor for the events listed below, at minimum. Account Lockouts (Subcategory: User Account Management) 4740 - A user account is locked out. User Added to Privileged Group (Subcategory: Security Group Management) 4728 - A member was added to a security-enabled global group. 4732 - A member was added to a security-enabled local group. 4756 - A member was added to a security-enabled universal group. Successful User Account Login (Subcategory: Logon) 4624 - An account was successfully logged on. Failed User Account Login (Subcategory: Logon) 4625 - An account failed to log on. Account Login with Explicit Credentials (Subcategory: Logon) 4648 - A logon was attempted using explicit credentials. The "Account Usage" section of NSA's "Spotting the Adversary with Windows Event Log Monitoring" provides additional information. https://www.iad.gov/iad/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 47E7E00721432249DBC12DBEBACC7D51EB9D1FDE ~~~~~ Category: Logon Audit On: Success and Failure Category: User Account Management Audit On: Success and Failure Category: Account Lockout Audit On: Success and Failure Category: Security Group Management Audit On: Success Queries of Events ===================== No event was found for EventID: 4740 No event was found for EventID: 4728 No event was found for EventID: 4732 No event was found for EventID: 4756 Event ID: 4624 Message: An account was successfully logged on. Level: Information Container Log: security Time Created: 10/23/2025 17:18:23 Event ID: 4625 Message: The EventSystem sub system is suppressing duplicate event log entries for a duration of 86400 seconds. Level: Information Container Log: application Time Created: 10/23/2025 17:00:12 Event ID: 4648 Message: A logon was attempted using explicit credentials. Level: Information Container Log: security Time Created: 10/23/2025 17:14:12 Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243491	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Systems must be monitored for attempts to use loca...	-
Check Text Verify attempts to use local accounts to log on remotely from other systems are being monitored. Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools. Monitor for the events listed below. If these events are not monitored, this is a finding. More advanced filtering is necessary to obtain the pertinent information than just looking for event IDs. Search for the event IDs listed with the following additional attributes: Logon Type = 3 (Network) Authentication Package Name = NTLM Not a domain logon and not the ANONYMOUS LOGON account Successful User Account Login (Subcategory: Logon) 4624 - An account was successfully logged on. Failed User Account Login (Subcategory: Logon) 4625 - An account failed to log on. Fix Text Monitor for attempts to use local accounts to log on remotely from other systems. Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools. Monitor for the events listed below. More advanced filtering is necessary to obtain the pertinent information than just looking for event IDs. Search for the event IDs listed with the following additional attributes: Logon Type = 3 (Network) Authentication Package Name = NTLM Not a domain logon and not the ANONYMOUS LOGON account Successful User Account Login (Subcategory: Logon) 4624 - An account was successfully logged on. Failed User Account Login (Subcategory: Logon) 4625 - An account failed to log on. The "Pass the Hash Detection" section of NSA's "Spotting the Adversary with Windows Event Log Monitoring" provides a sample query for filtering. https://www.iad.gov/iad/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: E089DA3611CD9E5684D67E52819E7E3F526453BF ~~~~~ Category: Logon Audit On: Success and Failure Category: Account Lockout Audit On: Success and Failure Queries of Events ===================== Event ID: 4624 Message: An account was successfully logged on. User: - Domain: - Level: Information Container Log: security Time Created: 10/23/2025 17:10:53 Event ID: 4625 Message: An account failed to log on. User: MNOCE-EMV-01$ Domain: ASHORE Level: Information Container Log: security Time Created: 10/23/2025 11:34:02 Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243492	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Systems must be monitored for remote desktop logon...	-
Check Text Verify Remote Desktop logins are being monitored. Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools. Monitor for the events listed below. If these events are not monitored, this is a finding. More advanced filtering is necessary to obtain the pertinent information than just looking for event IDs. Search for the event IDs listed with the following additional attributes: Logon Type = 10 (RemoteInteractive) Authentication Package Name = Negotiate Successful User Account Login (Subcategory: Logon) 4624 - An account was successfully logged on. Fix Text More advanced filtering is necessary to obtain the pertinent information than just looking for event IDs. Search for the event IDs listed with the following additional attributes: Logon Type = 10 (RemoteInteractive) Authentication Package Name = Negotiate Successful User Account Login (Subcategory: Logon) 4624 - An account was successfully logged on. The "Remote Desktop Logon Detection" section of NSA's "Spotting the Adversary with Windows Event Log Monitoring" provides a sample query for filtering. https://www.iad.gov/iad/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 5A31BB5A4B1EBDFAC4D7DD3C633345B86A64B193 ~~~~~ Category: Logon Audit On: Success and Failure Queries of Events ===================== No event was found for EventID: 4624 Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243493	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Active Directory data must be backed up daily for ...	-
Check Text Review the organization's procedures for the backing up active directory data. Verify the frequency at which active directory data is backed up. If the Availability categorization of the domain is low, this must be at least weekly. If the Availability categorization of the domain is moderate or high, this must be at least daily. Verify the type of backup is appropriate to capturing the directory data. For AD domain controllers, this must include a System State data backup. If any of these conditions are not met, this is a finding. Fix Text Update the organization's procedures for the backing up active directory data. Ensure the frequency at which active directory data is backed up is as follows: If the Availability categorization of the domain is low, this must be at least weekly. If the Availability categorization of the domain is moderate or high, this must be at least daily. Ensure the type of backup is appropriate to capturing the directory data. For AD domain controllers, this must include a System State data backup. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243495	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	A VPN must be used to protect directory network tr...	-
Check Text 1. Review the site's network diagram(s) to determine if domain controllers for the domain are located in multiple enclaves. The object is to determine if network traffic is traversing enclave network boundaries. 2. Request information about RODC or ADAM instances are installed. In particular, request details of Active Diretory functionality installed or extended into the DMZ or configured/allowed to cross the sites outbound firewall boundary. Ensure communications and replication traffic is encrypted. 3. If domain controllers are not located in multiple enclaves, then this check is not applicable. 4. If domain controllers are located in multiple enclaves, verify that a VPN is used to transport the network traffic (replication, user logon, queries, etc.). 5. If a VPN solution is not used to transport directory network traffic across enclave boundaries, then this is a finding. 6. If the ADAM mode is in use and a migration plan for converting to RODC is not in place, then this is a finding. Fix Text Implement a VPN or other network protection solution in accordance with the Network Infrastructure STIG that protects AD data in transit across DoD enclave boundaries. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 340AB6AA28AE4B02E7062963172834B876B28F0A ~~~~~ Hostname: MONT-DC-003.MONTFORD-POINT.navy.mil OperatingSystem: Windows Server 2016 Standard IPv4Address: 164.231.187.34 IPv6Address: ::1 Forest: MONTFORD-POINT.navy.mil Site: Default-First-Site-Name IsGlobalCatalog: True IsReadOnly: False Hostname: MONT-DC-004.MONTFORD-POINT.navy.mil OperatingSystem: Windows Server 2016 Standard IPv4Address: 164.231.187.35 IPv6Address: Forest: MONTFORD-POINT.navy.mil Site: Default-First-Site-Name IsGlobalCatalog: True IsReadOnly: False Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243496	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Accounts from outside directories that are not par...	-
Check Text 1. Start the Active Directory Users and Computers console (Start, Run, "dsa.msc"). 2. Select and expand the left pane item that matches the name of the domain being reviewed. 3. Select the Built-in container. a. If the Incoming Forest Trust Builders group is defined, double-click on the group, and select the Members tab b. Examine the defined accounts to see if they are from a domain that is not in the forest being reviewed. 4. Select the Users container a. For each group (Domain Admins, Enterprise Admins, Schema Admins, and Group Policy Creator Owners), double-click on the group, and select the Members tab. b. Examine the defined accounts to see if they are from a domain that is not in the forest being reviewed. 5. If any account in a privileged group is from a domain outside the forest being reviewed and that outside forest is not maintained by the same organization (e.g., enclave) or subject to the same security policies, then this is a finding. Supplementary Notes: Note: An account that is from an outside domain appears in the format "outside-domain-NetBIOSname\account" or "account@outside-domain-fully-qualified-name". Examples are "AOFN21\jsmit" or "jsmith@AOFN21.OST.COM". It may be necessary to use the AD Domains and Trusts (domain.msc) console to determine if the domain is from another AD forest. Note: It is possible to move the highly privileged AD security groups out of the AD Users container. If the Domain Admins, Enterprise Admins, Schema Admins, or Group Policy Creator Owners groups are not in the AD Users container, ask the SA for the new location and use that location for this check. Fix Text Remove accounts from outside directories that are not part of the same organization or are not subject to the same security policies from the highly privileged groups. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: C6936761C589D356CB5402667B38F66C7EB8DAA0 ~~~~~ 'Incoming Forest Trust Builders' - Contains no members 'Domain Admins' - All members from 'MONTFORD-POINT.navy.mil' forest 'Enterprise Admins' - All members from 'MONTFORD-POINT.navy.mil' forest 'Schema Admins' - All members from 'MONTFORD-POINT.navy.mil' forest 'Group Policy Creator Owners' - All members from 'MONTFORD-POINT.navy.mil' forest Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243497	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Inter-site replication must be enabled and configu...	-
Check Text Open "Active Directory Sites and Services". (Available from various menus or run "dssite.msc".) Expand "Sites" in the left pane. If only a single site exists, this is NA. By default the first site in a domain is named "Default-First-Site-Name" but may have been changed. If more than one site exists, expand "Inter-Site Transports" and select "IP". For each site link that is defined in the right pane perform the following: Right click the site link item and select "Properties". If the interval on the "General" tab for the "Replicate every" field is greater than "1440", this is a finding. Click the "Change Schedule" button. If the time frames selected for "Replication Available" do not allow for replication to occur at least daily, this is a finding. Click the Cancel buttons to exit. Fix Text Maintain an Active Directory replication schedule that allows inter-site replication to occur at least on a daily basis. Open "Active Directory Sites and Services". (Available from various menus or run "dssite.msc".) Expand "Sites" in the left pane. Expand "Inter-Site Transports" and select "IP". For each site link that is defined in the right pane perform the following: Right click the site link item and select "Properties". Select an interval in the "Replicate every" field less than "1440". (By default this is 180.) Click the Change Schedule button. Select time frames for "Replication Available" to allow for replication to occur at least daily. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 8BB538EB3700014FC44B5F8DD11DFA7BC48109A0 ~~~~~ Only one site exists so this requirement is NA. Site: Default-First-Site-Name Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243498	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	If a VPN is used in the AD implementation, the tra...	-
Check Text 1. Interview the site representative. Ask about the location of the domain controllers. 2. If domain controllers are not located in multiple enclaves, then this check is not applicable. 3. If domain controllers are located in multiple enclaves and a VPN is not used, then this check is not applicable. 4. If domain controllers are located in multiple enclaves and a VPN is used, review the site network diagram(s) with the SA, NSO, or network reviewer as required to determine if the AD network traffic is visible to a network or host IDS. 5. If the AD network traffic is not visible to a network or host IDS, then this is a finding. Fix Text Replace the VPN solution or reconfigure it so that directory data is inspected by a network or host-based IDS. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 340AB6AA28AE4B02E7062963172834B876B28F0A ~~~~~ Hostname: MONT-DC-003.MONTFORD-POINT.navy.mil OperatingSystem: Windows Server 2016 Standard IPv4Address: 164.231.187.34 IPv6Address: ::1 Forest: MONTFORD-POINT.navy.mil Site: Default-First-Site-Name IsGlobalCatalog: True IsReadOnly: False Hostname: MONT-DC-004.MONTFORD-POINT.navy.mil OperatingSystem: Windows Server 2016 Standard IPv4Address: 164.231.187.35 IPv6Address: Forest: MONTFORD-POINT.navy.mil Site: Default-First-Site-Name IsGlobalCatalog: True IsReadOnly: False Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243500	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Active Directory must be supported by multiple dom...	-
Check Text Determine the Availability categorization information for the domain. If the Availability categorization of the domain is low, this is NA. If the Availability categorization of the domain is moderate or high, verify the domain is supported by more than one domain controller. Start "Active Directory Users and Computers" (Available from various menus or run "dsa.msc"). Expand the left pane item that matches the domain being reviewed. Select the Domain Controllers Organizational Unit (OU) in the left pane. If there is only one domain controller in the OU, this is a finding. Fix Text Implement multiple domain controllers in domains with an Availability categorization of moderate or high. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 024E7C77D93E10021C4B7FF29988CA6DF95767DC ~~~~~ Multiple domain controllers exist in the domain. Hostname: MONT-DC-003.MONTFORD-POINT.navy.mil OperatingSystem: Windows Server 2016 Standard IPv4Address: 164.231.187.34 IPv6Address: ::1 Forest: MONTFORD-POINT.navy.mil Site: Default-First-Site-Name IsGlobalCatalog: True IsReadOnly: False Hostname: MONT-DC-004.MONTFORD-POINT.navy.mil OperatingSystem: Windows Server 2016 Standard IPv4Address: 164.231.187.35 IPv6Address: Forest: MONTFORD-POINT.navy.mil Site: Default-First-Site-Name IsGlobalCatalog: True IsReadOnly: False Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-269097	CAT II	MONT-DC-003	Active Directory Domain Security Technic...	Windows Server domain controllers must have Kerber...	Documented Pending Review
Check Text This applies to domain controllers only. It is not applicable for other systems. Verify the following is configured on the domain controller. Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon. If "Audit Kerberos Authentication Service" and "Audit Kerberos Ticket Operations" are not set to "Success and Failure", this is a finding. Fix Text Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon. Configure "Audit Kerberos Authentication Service" and the "Audit Kerberos Service Ticket Operations" to be set to "Success and Failure". Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be OPEN on 10/23/2025 ResultHash: 21368FE6539B8B519519A8F79490AF701CE1B0F5 ~~~~~ Kerberos Authentication Service: No Auditing Kerberos Service Ticket Operations: No Auditing Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243488	CAT III	MONT-DC-003	Active Directory Domain Security Technic...	User accounts with delegated authority must be rem...	-
Check Text 1. Interview the IAM or site representative and obtain the list of accounts that have been delegated AD object ownership or update permissions and that are not members of Windows built-in administrative groups. (This includes accounts for help desk or support personnel who are not Administrators, but have authority in AD to maintain user accounts or printers.) 2. If accounts with delegated authority are defined and there is no list, then this is a finding. 3. Count the number of accounts on the list. 4. If the number of accounts with delegated authority is greater than 10, review the site documentation that justifies this number. Validate that the IAM explicitly acknowledges the need to have a high number of privileged users. 5. If the number of accounts with delegated authority is greater than 10 and there is no statement in the documentation that justifies the number, then this is a finding. Fix Text 1. Remove user accounts with delegated authority from Windows built-in administrative groups or remove the delegated authority from the accounts. 2. Document all user accounts with delegated AD object ownership or update authority. 3. Annotate the account list with a statement such as, "The high number of privileged accounts is required to address site operational requirements." 4. Reduce the number of user accounts with delegated AD object ownership or update authority. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243494	CAT III	MONT-DC-003	Active Directory Domain Security Technic...	Each cross-directory authentication configuration ...	-
Check Text Start "Active Directory Domains and Trusts" (Available from various menus or run "domain.msc"). Select the left pane item that matches the name of the domain being reviewed. Right-click the domain name and select "Properties". Select the "Trusts" tab. For each outbound and inbound external, forest, and realm trust, record the name of the other party (domain name), the trust type, transitivity, and the trust direction. (Keep this trust information for use in subsequent checks.) Compare the list of trusts identified with documentation maintained by the ISSO. For each trust, the documentation must contain the following: Type (external, forest, or realm) Name of the other party Confidentiality, Availability, and Integrity categorization Classification level of the other party Trust direction (inbound and/or outbound) Transitivity Status of the Selective Authentication option Status of the SID filtering option If an identified trust is not listed in the documentation or if any of the required items are not documented, this is a finding. Fix Text Develop documentation for each AD external, forest, and realm trust configuration. At a minimum this must include: Type (external, forest, or realm) Name of the other party Confidentiality, Availability, and Integrity categorization Classification level of the other party Trust direction (inbound and/or outbound) Transitivity Status of the Selective Authentication option Status of the SID filtering option Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 48551156A5DDF0637531025EE03B12E7D7F6DBEE ~~~~~ No trusts are configured so this requirement is NA. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243499	CAT III	MONT-DC-003	Active Directory Domain Security Technic...	Active Directory implementation information must b...	-
Check Text Determine the Availability categorization information for the domain. If the Availability categorization of the domain is low, this is NA. If the Availability categorization of the domain is moderate or high, verify the organization's disaster recovery plans includes documentation on the AD hierarchy (forest, tree and domain structure). (A chart showing forest hierarchy and domain names is the minimum suggested.) If the disaster recovery plans do not include directory hierarchy information, this is a finding. Fix Text Update the disaster recovery plans to include the AD hierarchy structure for domains with an Availability categorization of moderate or high. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System
V-243501	CAT III	MONT-DC-003	Active Directory Domain Security Technic...	The impact of CPCON changes on the cross-directory...	-
Check Text 1. Refer to the list of actual manual AD trusts (cross-directory configurations) collected from the site representative. 2. If there are no manual AD trusts (cross-directory configurations) defined, this check is not applicable. For AD, this includes external, forest, or realm trust relationship types. 3. Obtain a copy of the site's supplemental CPCON procedures as required by Strategic Command Directive (SD) 527-1. 4. Verify that it has been determined by the IAM whether CPCON response actions need to include procedures to disable manual AD trusts (cross-directory configurations). The objective is to determine if the need has been explicitly evaluated. 5. If it has been determined that actions to disable manual AD trusts (cross-directory configurations) are not necessary, then this check is not applicable. 6. If it has been determined that actions to disable manual AD trusts (cross-directory configurations) are necessary, verify that the policy to implement these actions has been documented. 7. If actions to disable manual AD trusts (cross-directory configurations) are needed and no policy has been documented, then this is a finding. Fix Text Evaluate cross-directory configurations (such as trusts and pass-through authentication) and provide documentation that indicates: 1. An evaluation was performed. 2. The specific AD trust configurations, if any, that must be disabled during changes in CPCON status because they could represent increased risk. Finding Details Evaluate-STIG 1.2507.5 (Scan-ActiveDirectoryDomain_Checks) found this to be NOT APPLICABLE on 10/23/2025 ResultHash: 48551156A5DDF0637531025EE03B12E7D7F6DBEE ~~~~~ No trusts are configured so this requirement is NA. Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_ADDomain_V3R5_20251023-171837.ckl Scan Date: 2026-01-14T12:57:36.435963 Technology Area: Domain Name System

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Check Text

Fix Text

Check Text

Fix Text

Check Text

Fix Text

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Comments

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Finding Details

Check Text

Fix Text

Finding Details