################################################################################
DOCUMENT         : Windows_Server_2016_STIG
VERSION          : 2.7.9
CHECKSUM         : 4800befe87d9a15029edb0a82bcb59c4fd6adfaf42c01b4a8989601949b668ca
MANUAL QUESTIONS : 56

IMPORTANT: Make sure to save the completed version of this file to: 
<SCC Install>/Resources/Content/Manual_Questions/Completed_Files

This file contains all of the non-automated STIG requirements found in the STIG.
Results from this file will be combined with automated checks in SCC to provide
complete STIG compliance results.

This file will be programmaticaly imported, so do not modify anything in this file
except for placing an '[X]' to select a Single answer, and entering text comments.

The list of questions is printed in order of severity, listing CAT I (High), then CAT II, etc..

################################################################################

QUESTION         : 1 of 56
TITLE            : CAT I, V-224819, SV-224819r991589, SRG-OS-000480-GPOS-00227
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:1
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:1
RULE             : Users with Administrative privileges must have separate accounts for administrative duties and normal operational tasks.
QUESTION_TEXT    : Verify each user with administrative privileges has been assigned a unique administrative account separate from their standard user account. 

If users with administrative privileges do not have separate accounts for administrative functions and standard user functions, this is a finding.

References:
SV-87869
V-73217
CCI-000366

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 1 *******************************

QUESTION         : 2 of 56
TITLE            : CAT I, V-224821, SV-224821r991589, SRG-OS-000480-GPOS-00227
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:41
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:41
RULE             : Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email.
QUESTION_TEXT    : Determine whether organization policy, at a minimum, prohibits administrative accounts from using applications that access the Internet, such as web browsers, or with potential Internet sources, such as email, except as necessary for local service administration.

If it does not, this is a finding.

The organization may use technical means such as whitelisting to prevent the use of browsers and mail applications to enforce this requirement.

References:
SV-87877
V-73225
CCI-000366

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 2 *******************************

QUESTION         : 3 of 56
TITLE            : CAT I, V-224829, SV-224829r991589, SRG-OS-000480-GPOS-00227
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:201
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:201
RULE             : The Windows Server 2016 system must use an anti-virus program.
QUESTION_TEXT    : Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution.

If there is no anti-virus solution installed on the system, this is a finding.

Verify if Windows Defender is in use or enabled:

Open "PowerShell".

Enter "get-service | where {$_.DisplayName -Like "*Defender*"} | Select Status,DisplayName”

Verify if third-party anti-virus is in use or enabled:

Open "PowerShell".

Enter "get-service | where {$_.DisplayName -Like "*mcafee*"} | Select Status,DisplayName”

Enter "get-service | where {$_.DisplayName -Like "*symantec*"} | Select Status,DisplayName”

References:
SV-87893
V-73241
CCI-000366

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 3 *******************************

QUESTION         : 4 of 56
TITLE            : CAT I, V-224843, SV-224843r958552, SRG-OS-000185-GPOS-00079
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:481
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:481
RULE             : Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.
QUESTION_TEXT    : Verify systems that require additional protections due to factors such as inadequate physical protection or sensitivity of the data employ encryption to protect the confidentiality and integrity of all information at rest.

If they do not, this is a finding.

References:
SV-87925
V-73273
CCI-001199
CCI-002475
CCI-002476

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 4 *******************************

QUESTION         : 5 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT I, V-224964, SV-224964r958726, SRG-OS-000324-GPOS-00125
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:2861
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:2861
RULE             : Only administrators responsible for the domain controller must have Administrator rights on the system.
QUESTION_TEXT    : This applies to domain controllers. A separate version applies to other systems.

Review the Administrators group. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group.

Standard user accounts must not be members of the local administrator group.

If prohibited accounts are members of the local administrators group, this is a finding.

If the built-in Administrator account or other required administrative accounts are found on the system, this is not a finding.

References:
SV-87871
V-73219
CCI-002235

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 5 *******************************

QUESTION         : 6 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT I, V-224971, SV-224971r958726, SRG-OS-000324-GPOS-00125
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3001
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3001
RULE             : The Active Directory SYSVOL directory must have the proper access control permissions.
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Open a command prompt.

Run "net share".

Make note of the directory location of the SYSVOL share.

By default, this will be \Windows\SYSVOL\sysvol. For this requirement, permissions will be verified at the first SYSVOL directory level.

If any standard user accounts or groups have greater than "Read & execute" permissions, this is a finding. 

The default permissions noted below meet this requirement.

Open "Command Prompt".

Run "icacls c:\Windows\SYSVOL".

The following results should be displayed:

NT AUTHORITY\Authenticated Users:(RX)
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(GR,GE)
BUILTIN\Server Operators:(RX)
BUILTIN\Server Operators:(OI)(CI)(IO)(GR,GE)
BUILTIN\Administrators:(M,WDAC,WO)
BUILTIN\Administrators:(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(F)
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
BUILTIN\Administrators:(M,WDAC,WO)
CREATOR OWNER:(OI)(CI)(IO)(F)

(RX) - Read & execute 

Run "icacls /help" to view definitions of other permission codes.

References:
SV-88023
V-73371
CCI-002235

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 6 *******************************

QUESTION         : 7 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT I, V-224972, SV-224972r958726, SRG-OS-000324-GPOS-00125
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3021
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3021
RULE             : Active Directory Group Policy objects must have proper access control permissions.
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Review the permissions on Group Policy objects.

Open "Group Policy Management" (available from various menus or run "gpmc.msc").

Navigate to "Group Policy Objects" in the domain being reviewed (Forest >> Domains >> Domain).

For each Group Policy object:

Select the Group Policy object item in the left pane.

Select the "Delegation" tab in the right pane.

Select the "Advanced" button.

Select each Group or user name.

View the permissions.

If any standard user accounts or groups have "Allow" permissions greater than "Read" and "Apply group policy", this is a finding.

Other access permissions that allow the objects to be updated are considered findings unless specifically documented by the ISSO.

The default permissions noted below satisfy this requirement. 

The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the next "Advanced" button, the desired Permission entry, and the "Edit" button.

Authenticated Users - Read, Apply group policy, Special permissions

The special permissions for Authenticated Users are for Read-type Properties. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding.

The special permissions for the following default groups are not the focus of this requirement and may include a wide range of permissions and properties.

CREATOR OWNER - Special permissions
SYSTEM - Read, Write, Create all child objects, Delete all child objects, Special permissions
Domain Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions
Enterprise Admins - Read, Write, Create all child objects, Delete all child objects, Special permissions
ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions

The Domain Admins and Enterprise Admins will not have the "Delete all child objects" permission on the two default Group Policy objects: Default Domain Policy and Default Domain Controllers Policy. They will have this permission on organization created Group Policy objects.

References:
SV-88025
V-73373
CCI-002235

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 7 *******************************

QUESTION         : 8 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT I, V-224973, SV-224973r958726, SRG-OS-000324-GPOS-00125
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3041
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3041
RULE             : The Active Directory Domain Controllers Organizational Unit (OU) object must have the proper access control permissions.
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Review the permissions on the Domain Controllers OU.

Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc").

Select "Advanced Features" in the "View" menu if not previously selected.

Select the "Domain Controllers" OU (folder in folder icon).

Right-click and select "Properties".

Select the "Security" tab.

If the permissions on the Domain Controllers OU do not restrict changes to System, Domain Admins, Enterprise Admins and Administrators, this is a finding.

The default permissions listed below satisfy this requirement.

Domains supporting Microsoft Exchange will have additional Exchange related permissions on the Domain Controllers OU.  These may include some change related permissions and are not a finding.

The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "View" or "Edit" button.

Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement.

CREATOR OWNER - Special permissions

SELF - Special permissions

Authenticated Users - Read, Special permissions

The special permissions for Authenticated Users are Read types.

If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding.

SYSTEM - Full Control

Domain Admins - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions

Enterprise Admins - Full Control

Key Admins - Special permissions

Enterprise Key Admins - Special permissions

Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions

Pre-Windows 2000 Compatible Access - Special permissions

The Special permissions for Pre-Windows 2000 Compatible Access are Read types.

If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding.

ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions

References:
SV-88027
V-73375
CCI-002235

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 8 *******************************

QUESTION         : 9 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT I, V-224974, SV-224974r958726, SRG-OS-000324-GPOS-00125
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3061
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3061
RULE             : Domain-created Active Directory Organizational Unit (OU) objects must have proper access control permissions.
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Review the permissions on domain-defined OUs.

Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc").

Ensure "Advanced Features" is selected in the "View" menu.

For each OU that is defined (folder in folder icon) excluding the Domain Controllers OU:

Right-click the OU and select "Properties".

Select the "Security" tab.

If the permissions on the OU are not at least as restrictive as those below, this is a finding.

The permissions shown are at the summary level. More detailed permissions can be viewed by selecting the "Advanced" button, the desired Permission entry, and the "Edit" or "View" button.

Except where noted otherwise, the special permissions may include a wide range of permissions and properties and are acceptable for this requirement.

CREATOR OWNER - Special permissions

Self - Special permissions

Authenticated Users - Read, Special permissions

The Special permissions for Authenticated Users are Read type. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding.

SYSTEM - Full Control

Domain Admins - Full Control

Enterprise Admins - Full Control

Key Admins - Special permissions

Enterprise Key Admins - Special permissions

Administrators - Read, Write, Create all child objects, Generate resultant set of policy (logging), Generate resultant set of policy (planning), Special permissions

Pre-Windows 2000 Compatible Access - Special permissions

The Special permissions for Pre-Windows 2000 Compatible Access are for Read types. If detailed permissions include any Create, Delete, Modify, or Write Permissions or Properties, this is a finding.

ENTERPRISE DOMAIN CONTROLLERS - Read, Special permissions

If an ISSO-approved distributed administration model (help desk or other user support staff) is implemented, permissions above Read may be allowed for groups documented by the ISSO.

If any OU with improper permissions includes identification or authentication data (e.g., accounts, passwords, or password hash data) used by systems to determine access control, the severity is CAT I (e.g., OUs that include user accounts, including service/application accounts).

If an OU with improper permissions does not include identification and authentication data used by systems to determine access control, the severity is CAT II (e.g., Workstation, Printer OUs).

References:
SV-88029
V-73377
CCI-002235

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 9 *******************************

QUESTION         : 10 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT I, V-224978, SV-224978r991589, SRG-OS-000480-GPOS-00227
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3141
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3141
RULE             : Directory data (outside the root DSE) of a non-public directory must be configured to prevent anonymous access.
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Open "Command Prompt" (not elevated).

Run "ldp.exe".

From the "Connection menu", select "Bind".

Clear the User, Password, and Domain fields.

Select "Simple bind" for the Bind type and click "OK".

Confirmation of anonymous access will be displayed at the end:

res = ldap_simple_bind_s
Authenticated as: 'NT AUTHORITY\ANONYMOUS LOGON'

From the "Browse" menu, select "Search".

In the Search dialog, enter the DN of the domain naming context (generally something like "dc=disaost,dc=mil") in the Base DN field.

Clear the Attributes field and select "Run".

Error messages should display related to Bind and user not authenticated.

If attribute data is displayed, anonymous access is enabled to the domain naming context and this is a finding.

The following network controls allow the finding severity to be downgraded to a CAT II since these measures lower the risk associated with anonymous access.

Network hardware ports at the site are subject to 802.1x authentication or MAC address restrictions. 

Premise firewall or host restrictions prevent access to ports 389, 636, 3268, and 3269 from client hosts not explicitly identified by domain (.mil) or IP address.

References:
SV-88037
V-73385
CCI-000366

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 10 *******************************

QUESTION         : 11 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT I, V-224992, SV-224992r958448, SRG-OS-000066-GPOS-00034
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3401
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3401
RULE             : Domain Controller PKI certificates must be issued by the DoD PKI or an approved External Certificate Authority (ECA).
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Run "MMC".

Select "Add/Remove Snap-in" from the "File" menu.

Select "Certificates" in the left pane and click the "Add >" button.

Select "Computer Account" and click "Next".

Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish".

Click "OK".

Select and expand the Certificates (Local Computer) entry in the left pane.

Select and expand the Personal entry in the left pane.

Select the Certificates entry in the left pane.

In the right pane, examine the "Issued By" field for the certificate to determine the issuing CA.

If the "Issued By" field of the PKI certificate being used by the domain controller does not indicate the issuing CA is part of the DoD PKI or an approved ECA, this is a finding.

If the certificates in use are issued by a CA authorized by the Component's CIO, this is a CAT II finding.

There are multiple sources from which lists of valid DoD CAs and approved ECAs can be obtained: 

The Global Directory Service (GDS) website provides an online source. The address for this site is https://crl.gds.disa.mil.

DoD Public Key Enablement (PKE) Engineering Support maintains the InstallRoot utility to manage DoD supported root certificates on Windows computers, which includes a list of authorized CAs. The utility package can be downloaded from the PKI and PKE Tools page on IASE:

http://iase.disa.mil/pki-pke/function_pages/tools.html

References:
V-73613
SV-88277
CCI-000185

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 11 *******************************

QUESTION         : 12 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT I, V-224993, SV-224993r958448, SRG-OS-000066-GPOS-00034
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3421
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3421
RULE             : PKI certificates associated with user accounts must be issued by the DoD PKI or an approved External Certificate Authority (ECA).
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Review user account mappings to PKI certificates.

Open "Windows PowerShell".

Enter "Get-ADUser -Filter * | FT Name, UserPrincipalName, Enabled".

Exclude disabled accounts (e.g., DefaultAccount, Guest) and the krbtgt account.

If the User Principal Name (UPN) is not in the format of an individual's identifier for the certificate type and for the appropriate domain suffix, this is a finding.

For standard NIPRNet certificates the individual's identifier is in the format of an Electronic Data Interchange - Personnel Identifier (EDI-PI).

Alt Tokens and other certificates may use a different UPN format than the EDI-PI which vary by organization. Verified these with the organization.

NIPRNet Example:
Name - User Principal Name
User1 - 1234567890@mil

See PKE documentation for other network domain suffixes.

If the mappings are to certificates issued by a CA authorized by the Component's CIO, this is a CAT II finding.

References:
V-73615
SV-88279
CCI-000185

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 12 *******************************

QUESTION         : 13 of 56
APPLICABILITY    : Windows_StandaloneServer_or_MemberServer
TITLE            : CAT I, V-225007, SV-225007r958726, SRG-OS-000324-GPOS-00125
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3701
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3701
RULE             : Only administrators responsible for the member server or standalone or nondomain-joined system must have Administrator rights on the system.
QUESTION_TEXT    : This applies to member servers and standalone or nondomain-joined systems. A separate version applies to domain controllers.

Open "Computer Management".

Navigate to "Groups" under "Local Users and Groups".

Review the local "Administrators" group.

Only administrator groups or accounts responsible for administration of the system may be members of the group.

For domain-joined member servers, the Domain Admins group must be replaced by a domain member server administrator group.

Standard user accounts must not be members of the local Administrator group.

If accounts that do not have responsibility for administration of the system are members of the local Administrators group, this is a finding.

If the built-in Administrator account or other required administrative accounts are found on the system, this is not a finding.

References:
SV-87873
V-73221
CCI-002235

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 13 *******************************

QUESTION         : 14 of 56
APPLICABILITY    : Windows_MemberServer
TITLE            : CAT I, V-225012, SV-225012r991589, SRG-OS-000480-GPOS-00227
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3801
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3801
RULE             : Windows Server 2016 must be running Credential Guard on domain-joined member servers.
QUESTION_TEXT    : For domain controllers and standalone or nondomain-joined systems, this is NA.

Open "PowerShell" with elevated privileges (run as administrator).

Enter the following:

"Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard"

If "SecurityServicesRunning" does not include a value of "1" (e.g., "{1, 2}"), this is a finding.

Alternately:

Run "System Information".

Under "System Summary", verify the following:

If "Device Guard Security Services Running" does not list "Credential Guard", this is a finding.

The policy settings referenced in the Fix section will configure the following registry value. However, due to hardware requirements, the registry value alone does not ensure proper function.

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\

Value Name: LsaCfgFlags
Value Type: REG_DWORD
Value: 0x00000001 (1) (Enabled with UEFI lock)

A Microsoft article on Credential Guard system requirement can be found at the following link:

https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-requirements

References:
SV-88167
V-73515
CCI-000366

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 14 *******************************

QUESTION         : 15 of 56
TITLE            : CAT II, V-224820, SV-224820r982200, SRG-OS-000076-GPOS-00044
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:21
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:21
RULE             : Passwords for the built-in Administrator account must be changed at least every 60 days.
QUESTION_TEXT    : Review the password last set date for the built-in Administrator account.

Domain controllers:

Open "PowerShell".

Enter "Get-ADUser -Filter * -Properties SID, PasswordLastSet | Where SID -Like "*-500" | Ft Name, SID, PasswordLastSet".

If the "PasswordLastSet" date is greater than "60" days old, this is a finding.

Member servers and standalone or nondomain-joined systems:

Open "Command Prompt".

Enter 'Net User [account name] | Find /i "Password Last Set"', where [account name] is the name of the built-in administrator account.

(The name of the built-in Administrator account must be changed to something other than "Administrator" per STIG requirements.)

If the "PasswordLastSet" date is greater than "60" days old, this is a finding.

References:
V-73223
SV-87875
CCI-000199

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 15 *******************************

QUESTION         : 16 of 56
TITLE            : CAT II, V-224822, SV-224822r991589, SRG-OS-000480-GPOS-00227
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:61
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:61
RULE             : Members of the Backup Operators group must have separate accounts for backup duties and normal operational tasks.
QUESTION_TEXT    : If no accounts are members of the Backup Operators group, this is NA.

Verify users with accounts in the Backup Operators group have a separate user account for backup functions and for performing normal user tasks.

If users with accounts in the Backup Operators group do not have separate accounts for backup functions and standard user functions, this is a finding.

References:
SV-87879
V-73227
CCI-000366

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 16 *******************************

QUESTION         : 17 of 56
TITLE            : CAT II, V-224823, SV-224823r1016376, SRG-OS-000078-GPOS-00046
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:81
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:81
RULE             : Manually managed application account passwords must be at least 14 characters in length.
QUESTION_TEXT    : Determine if manually managed application/service accounts exist. If none exist, this is NA.

Verify the organization has a policy to ensure passwords for manually managed application/service accounts are at least 14 characters in length.

If such a policy does not exist or has not been implemented, this is a finding.

References:
V-73229
SV-87881
CCI-000205

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 17 *******************************

QUESTION         : 18 of 56
TITLE            : CAT II, V-224824, SV-224824r991589, SRG-OS-000480-GPOS-00227
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:101
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:101
RULE             : Manually managed application account passwords must be changed at least annually or when a system administrator with knowledge of the password leaves the organization.
QUESTION_TEXT    : Determine if manually managed application/service accounts exist. If none exist, this is NA.

If passwords for manually managed application/service accounts are not changed at least annually or when an administrator with knowledge of the password leaves the organization, this is a finding.

Identify manually managed application/service accounts.

To determine the date a password was last changed:

Domain controllers:

Open "PowerShell".

Enter "Get-AdUser -Identity [application account name] -Properties PasswordLastSet | FT Name, PasswordLastSet", where [application account name] is the name of the manually managed application/service account.

If the "PasswordLastSet" date is more than one year old, this is a finding.

Member servers and standalone or nondomain-joined systems:

Open "Command Prompt".

Enter 'Net User [application account name] | Find /i "Password Last Set"', where [application account name] is the name of the manually managed application/service account.

If the "Password Last Set" date is more than one year old, this is a finding.

References:
SV-87883
V-73231
CCI-000366

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 18 *******************************

QUESTION         : 19 of 56
TITLE            : CAT II, V-224825, SV-224825r958482, SRG-OS-000104-GPOS-00051
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:121
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:121
RULE             : Shared user accounts must not be permitted on the system.
QUESTION_TEXT    : Determine whether any shared accounts exist. If no shared accounts exist, this is NA.

Shared accounts, such as required by an application, may be approved by the organization.  This must be documented with the ISSO. Documentation must include the reason for the account, who has access to the account, and how the risk of using the shared account is mitigated to include monitoring account activity.

If unapproved shared accounts exist, this is a finding.

References:
V-73233
SV-87885
CCI-000764

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 19 *******************************

QUESTION         : 20 of 56
TITLE            : CAT II, V-224826, SV-224826r958808, SRG-OS-000370-GPOS-00155
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:141
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:141
RULE             : Windows Server 2016 must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
QUESTION_TEXT    : Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs.

If an application allowlisting program is not in use on the system, this is a finding.

Configuration of allowlisting applications will vary by the program.

AppLocker is an allowlisting application built into Windows Server. A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules.

If AppLocker is used, perform the following to view the configuration of AppLocker:

Open "PowerShell".

If the AppLocker PowerShell module has not been imported previously, execute the following first:

Import-Module AppLocker

Execute the following command, substituting [c:\temp\file.xml] with a location and file name appropriate for the system:

Get-AppLockerPolicy -Effective -XML > c:\temp\file.xml

This will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review.

Implementation guidance for AppLocker is available at the following link:

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide

References:
SV-87887
V-73235
CCI-001774

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 20 *******************************

QUESTION         : 21 of 56
TITLE            : CAT II, V-224830, SV-224830r991589, SRG-OS-000480-GPOS-00227
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:221
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:221
RULE             : Servers must have a host-based intrusion detection or prevention system.
QUESTION_TEXT    : Determine whether there is a HIDS or HIPS on each server. 

If the HIPS component of ESS is installed and active on the host and the alerts of blocked activity are being logged and monitored, this meets the requirement. 

A HIDS device is not required on a system that has the role as the Network Intrusion Device (NID). However, this exception needs to be documented with the ISSO.

If a HIDS is not installed on the system, this is a finding.

References:
SV-87897
V-73245
CCI-000366

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 21 *******************************

QUESTION         : 22 of 56
TITLE            : CAT II, V-224832, SV-224832r958702, SRG-OS-000312-GPOS-00122
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:261
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:261
RULE             : Permissions for the system drive root directory (usually C:\) must conform to minimum requirements.
QUESTION_TEXT    : The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290).

Review the permissions for the system drive's root directory (usually C:\). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.)

If permissions are not as restrictive as the default permissions listed below, this is a finding.

Viewing in File Explorer:

View the Properties of the system drive's root directory.

Select the "Security" tab, and the "Advanced" button.

Default permissions:
C:\
Type - "Allow" for all
Inherited from - "None" for all

Principal - Access - Applies to

SYSTEM - Full control - This folder, subfolders, and files
Administrators - Full control - This folder, subfolders, and files
Users - Read & execute - This folder, subfolders, and files
Users - Create folders/append data - This folder and subfolders
Users - Create files/write data - Subfolders only
CREATOR OWNER - Full Control - Subfolders and files only

Alternately, use icacls:

Open "Command Prompt (Admin)".

Enter "icacls" followed by the directory:

"icacls c:\"

The following results should be displayed:

c:\
NT AUTHORITY\SYSTEM:(OI)(CI)(F)
BUILTIN\Administrators:(OI)(CI)(F)
BUILTIN\Users:(OI)(CI)(RX)
BUILTIN\Users:(CI)(AD)
BUILTIN\Users:(CI)(IO)(WD)
CREATOR OWNER:(OI)(CI)(IO)(F)
Successfully processed 1 files; Failed processing 0 files

References:
SV-87901
V-73249
CCI-002165

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 22 *******************************

QUESTION         : 23 of 56
TITLE            : CAT II, V-224833, SV-224833r958702, SRG-OS-000312-GPOS-00122
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:281
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:281
RULE             : Permissions for program file directories must conform to minimum requirements.
QUESTION_TEXT    : The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290).

Review the permissions for the program file directories (Program Files and Program Files [x86]). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. (Individual accounts must not be used to assign permissions.)

If permissions are not as restrictive as the default permissions listed below, this is a finding.

Viewing in File Explorer:

For each folder, view the Properties.

Select the "Security" tab, and the "Advanced" button.

Default permissions:
\Program Files and \Program Files (x86)
Type - "Allow" for all
Inherited from - "None" for all

Principal - Access - Applies to

TrustedInstaller - Full control - This folder and subfolders
SYSTEM - Modify - This folder only
SYSTEM - Full control - Subfolders and files only
Administrators - Modify - This folder only
Administrators - Full control - Subfolders and files only
Users - Read & execute - This folder, subfolders and files
CREATOR OWNER - Full control - Subfolders and files only
ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files
ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files

Alternately, use icacls:

Open a Command prompt (admin).

Enter "icacls" followed by the directory:

'icacls "c:\program files"'
'icacls "c:\program files (x86)"'

The following results should be displayed for each when entered:

c:\program files (c:\program files (x86))
NT SERVICE\TrustedInstaller:(F)
NT SERVICE\TrustedInstaller:(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(M)
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
BUILTIN\Administrators:(M)
BUILTIN\Administrators:(OI)(CI)(IO)(F)
BUILTIN\Users:(RX)
BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
CREATOR OWNER:(OI)(CI)(IO)(F)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)
Successfully processed 1 files; Failed processing 0 files

References:
SV-87903
V-73251
CCI-002165

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 23 *******************************

QUESTION         : 24 of 56
TITLE            : CAT II, V-224834, SV-224834r958702, SRG-OS-000312-GPOS-00122
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:301
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:301
RULE             : Permissions for the Windows installation directory must conform to minimum requirements.
QUESTION_TEXT    : The default permissions are adequate when the Security Option "Network access: Let everyone permissions apply to anonymous users" is set to "Disabled" (WN16-SO-000290).

Review the permissions for the Windows installation directory (usually C:\Windows). Non-privileged groups such as Users or Authenticated Users must not have greater than "Read & execute" permissions. (Individual accounts must not be used to assign permissions.)

If permissions are not as restrictive as the default permissions listed below, this is a finding.

Viewing in File Explorer:

For each folder, view the Properties.

Select the "Security" tab and the "Advanced" button.

Default permissions:
\Windows
Type - "Allow" for all
Inherited from - "None" for all

Principal - Access - Applies to

TrustedInstaller - Full control - This folder and subfolders
SYSTEM - Modify - This folder only
SYSTEM - Full control - Subfolders and files only
Administrators - Modify - This folder only
Administrators - Full control - Subfolders and files only
Users - Read & execute - This folder, subfolders, and files
CREATOR OWNER - Full control - Subfolders and files only
ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files
ALL RESTRICTED APPLICATION PACKAGES - Read & execute - This folder, subfolders, and files

Alternately, use icacls:

Open a Command prompt (admin).

Enter "icacls" followed by the directory:

"icacls c:\windows"

The following results should be displayed for each when entered:

c:\windows
NT SERVICE\TrustedInstaller:(F)
NT SERVICE\TrustedInstaller:(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(M)
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
BUILTIN\Administrators:(M)
BUILTIN\Administrators:(OI)(CI)(IO)(F)
BUILTIN\Users:(RX)
BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
CREATOR OWNER:(OI)(CI)(IO)(F)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(RX)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE)
Successfully processed 1 files; Failed processing 0 files

References:
SV-87905
V-73253
CCI-002165

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 24 *******************************

QUESTION         : 25 of 56
TITLE            : CAT II, V-224835, SV-224835r958726, SRG-OS-000324-GPOS-00125
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:321
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:321
RULE             : Default permissions for the HKEY_LOCAL_MACHINE registry hive must be maintained.
QUESTION_TEXT    : Review the registry permissions for the keys of the HKEY_LOCAL_MACHINE hive noted below.

If any non-privileged groups such as Everyone, Users, or Authenticated Users have greater than Read permission, this is a finding.

If permissions are not as restrictive as the default permissions listed below, this is a finding.

Run "Regedit".

Right-click on the registry areas noted below.

Select "Permissions..." and the "Advanced" button.

HKEY_LOCAL_MACHINE\SECURITY

Type - "Allow" for all
Inherited from - "None" for all
Principal - Access - Applies to
SYSTEM - Full Control - This key and subkeys
Administrators - Special - This key and subkeys

HKEY_LOCAL_MACHINE\SOFTWARE

Type - "Allow" for all
Inherited from - "None" for all
Principal - Access - Applies to
Users - Read - This key and subkeys
Administrators - Full Control - This key and subkeys
SYSTEM - Full Control - This key and subkeys
CREATOR OWNER - Full Control - This key and subkeys
ALL APPLICATION PACKAGES - Read - This key and subkeys

HKEY_LOCAL_MACHINE\SYSTEM

Type - "Allow" for all
Inherited from - "None" for all
Principal - Access - Applies to
Users - Read - This key and subkeys
Administrators - Full Control - This key and subkeys
SYSTEM - Full Control - This key and subkeys
CREATOR OWNER - Full Control - Subkeys only
ALL APPLICATION PACKAGES - Read - This key and subkeys
Server Operators – Read – This Key and subkeys    (Domain controllers only) 

Other examples under the noted keys may also be sampled. There may be some instances where non-privileged groups have greater than Read permission.

If the defaults have not been changed, these are not a finding.

References:
SV-87907
V-73255
CCI-002235

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 25 *******************************

QUESTION         : 26 of 56
TITLE            : CAT II, V-224837, SV-224837r958482, SRG-OS-000104-GPOS-00051
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:361
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:361
RULE             : Outdated or unused accounts must be removed from the system or disabled.
QUESTION_TEXT    : Open "Windows PowerShell".

Domain Controllers:

Enter "Search-ADAccount -AccountInactive -UsersOnly -TimeSpan 35.00:00:00"

This will return accounts that have not been logged on to for 35 days, along with various attributes such as the Enabled status and LastLogonDate.

Member servers and standalone or nondomain-joined systems:

Copy or enter the lines below to the PowerShell window and enter. (Entering twice may be required. Do not include the quotes at the beginning and end of the query.)

"([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach {
 $user = ([ADSI]$_.Path)
 $lastLogin = $user.Properties.LastLogin.Value
 $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2
 if ($lastLogin -eq $null) {
 $lastLogin = 'Never'
 }
 Write-Host $user.Name $lastLogin $enabled 
}"

This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False).
For example: User1 10/31/2015 5:49:56 AM True

Review the list of accounts returned by the above queries to determine the finding validity for each account reported.

Exclude the following accounts:

- Built-in administrator account (Renamed, SID ending in 500)
- Built-in guest account (Renamed, Disabled, SID ending in 501)
- Built-in default account (Renamed, Disabled, SID ending in 503)
- Application accounts

If any enabled accounts have not been logged on to within the past 35 days, this is a finding.

Inactive accounts that have been reviewed and deemed to be required must be documented with the ISSO.

References:
V-73259
SV-87911
CCI-000764
CCI-000795

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 26 *******************************

QUESTION         : 27 of 56
TITLE            : CAT II, V-224840, SV-224840r958794, SRG-OS-000363-GPOS-00150
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:421
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:421
RULE             : System files must be monitored for unauthorized changes.
QUESTION_TEXT    : Determine if the system is monitored for unauthorized changes to system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) against a baseline on a weekly basis.

If system files are not being monitored for unauthorized changes, this is a finding. 

An approved and properly configured solution will contain both a list of baselines that includes all system file locations and a file comparison task that is scheduled to run at least weekly.

References:
SV-87917
V-73265
CCI-001744

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 27 *******************************

QUESTION         : 28 of 56
TITLE            : CAT II, V-224841, SV-224841r958524, SRG-OS-000138-GPOS-00069
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:441
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:441
RULE             : Non-system-created file shares on a system must limit access to groups that require it.
QUESTION_TEXT    : If only system-created shares such as "ADMIN$", "C$", and "IPC$" exist on the system, this is NA. (System-created shares will display a message that it has been shared for administrative purposes when "Properties" is selected.)

Run "Computer Management".

Navigate to System Tools >> Shared Folders >> Shares.

Right-click any non-system-created shares.

Select "Properties".

Select the "Share Permissions" tab.

If the file shares have not been configured to restrict permissions to the specific groups or accounts that require access, this is a finding.

Select the "Security" tab.

If the permissions have not been configured to restrict permissions to the specific groups or accounts that require access, this is a finding.

References:
V-73267
SV-87919
CCI-001090

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 28 *******************************

QUESTION         : 29 of 56
TITLE            : CAT II, V-224842, SV-224842r991589, SRG-OS-000480-GPOS-00227
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:461
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:461
RULE             : Software certificate installation files must be removed from Windows Server 2016.
QUESTION_TEXT    : Search all drives for *.p12 and *.pfx files.

If any files with these extensions exist, this is a finding.

This does not apply to server-based applications that have a requirement for .p12 certificate files or Adobe PreFlight certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO.

References:
SV-87923
V-73271
CCI-000366

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 29 *******************************

QUESTION         : 30 of 56
TITLE            : CAT II, V-224844, SV-224844r958912, SRG-OS-000425-GPOS-00189
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:501
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:501
RULE             : Protection methods such as TLS, encrypted VPNs, or IPsec must be implemented if the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process.
QUESTION_TEXT    : If the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, verify protection methods such as TLS, encrypted VPNs, or IPsec have been implemented.

If protection methods have not been implemented, this is a finding.

References:
SV-87927
V-73275
CCI-002420
CCI-002422

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 30 *******************************

QUESTION         : 31 of 56
TITLE            : CAT II, V-224845, SV-224845r958478, SRG-OS-000095-GPOS-00049
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:521
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:521
RULE             : The roles and features required by the system must be documented.
QUESTION_TEXT    : Required roles and features will vary based on the function of the individual system.

Roles and features specifically required to be disabled per the STIG are identified in separate requirements.

If the organization has not documented the roles and features required for the system(s), this is a finding.

The PowerShell command "Get-WindowsFeature" will list all roles and features with an "Install State".

References:
SV-87929
V-73277
CCI-000381

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 31 *******************************

QUESTION         : 32 of 56
TITLE            : CAT II, V-224846, SV-224846r991589, SRG-OS-000480-GPOS-00227
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:541
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:541
RULE             : A host-based firewall must be installed and enabled on the system.
QUESTION_TEXT    : Determine if a host-based firewall is installed and enabled on the system.

If a host-based firewall is not installed and enabled on the system, this is a finding.

The configuration requirements will be determined by the applicable firewall STIG.

References:
SV-87931
V-73279
CCI-000366
CCI-002080

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 32 *******************************

QUESTION         : 33 of 56
TITLE            : CAT II, V-224847, SV-224847r982191, SRG-OS-000191-GPOS-00080
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:561
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:561
RULE             : Windows  Server 2016 must employ automated mechanisms to determine the state of  system components with regard to flaw remediation using the following  frequency: continuously, where Endpoint Security Solution (ESS) is  used; 30 days, for any additional internal network scans not covered by ESS; and annually, for external scans by Computer Network Defense  Service Provider (CNDSP).
QUESTION_TEXT    : Verify DoD-approved ESS software is installed and properly operating. Ask the site ISSM for documentation of the ESS software installation and configuration.

If the ISSM is not able to provide a documented configuration for an installed ESS or if the ESS software is not properly maintained or used, this is a finding.

Note: Example of documentation can be a copy of the site's CCB approved Software Baseline with version of software noted or a memo from the ISSM stating current ESS software and version.

References:
SV-87933
V-73281
CCI-001233

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 33 *******************************

QUESTION         : 34 of 56
TITLE            : CAT II, V-224848, SV-224848r958364, SRG-OS-000002-GPOS-00002
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:581
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:581
RULE             : Windows Server 2016 must automatically remove or disable temporary user accounts after 72 hours.
QUESTION_TEXT    : Review temporary user accounts for expiration dates.

Determine if temporary user accounts are used and identify any that exist. If none exist, this is NA.

Domain Controllers:

Open "PowerShell".

Enter "Search-ADAccount -AccountExpiring | FT Name, AccountExpirationDate".

If "AccountExpirationDate" has not been defined within 72 hours for any temporary user account, this is a finding.

Member servers and standalone or nondomain-joined systems:

Open "Command Prompt".

Run "Net user [username]", where [username] is the name of the temporary user account.

If "Account expires" has not been defined within 72 hours for any temporary user account, this is a finding.

References:
SV-87935
V-73283
CCI-000016

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 34 *******************************

QUESTION         : 35 of 56
TITLE            : CAT II, V-224849, SV-224849r958508, SRG-OS-000123-GPOS-00064
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:601
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:601
RULE             : Windows Server 2016 must automatically remove or disable emergency accounts after the crisis is resolved or within 72 hours.
QUESTION_TEXT    : Determine if emergency administrator accounts are used and identify any that exist. If none exist, this is NA.

If emergency administrator accounts cannot be configured with an expiration date due to an ongoing crisis, the accounts must be disabled or removed when the crisis is resolved.

If emergency administrator accounts have not been configured with an expiration date or have not been disabled or removed following the resolution of a crisis, this is a finding.

Domain Controllers:

Open "PowerShell".

Enter "Search-ADAccount –AccountExpiring | FT Name, AccountExpirationDate".

If "AccountExpirationDate" has been defined and is not within 72 hours for an emergency administrator account, this is a finding.

Member servers and standalone or nondomain-joined systems:

Open "Command Prompt".

Run "Net user [username]", where [username] is the name of the emergency account.

If "Account expires" has been defined and is not within 72 hours for an emergency administrator account, this is a finding.

References:
V-73285
SV-87937
CCI-001682

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 35 *******************************

QUESTION         : 36 of 56
TITLE            : CAT II, V-224861, SV-224861r991589, SRG-OS-000480-GPOS-00227
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:841
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:841
RULE             : FTP servers must be configured to prevent access to the system drive.
QUESTION_TEXT    : If FTP is not installed on the system, this is NA.

Open "Internet Information Services (IIS) Manager".

Select "Sites" under the server name.

For any sites with a Binding that lists FTP, right-click the site and select "Explore".

If the site is not defined to a specific folder for shared FTP resources, this is a finding.

If the site includes any system areas such as root of the drive, Program Files, or Windows directories, this is a finding.

References:
SV-87957
V-73305
CCI-000366

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 36 *******************************

QUESTION         : 37 of 56
TITLE            : CAT II, V-224863, SV-224863r991589, SRG-OS-000480-GPOS-00227
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:881
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:881
RULE             : Orphaned security identifiers (SIDs) must be removed from user rights on Windows 2016.
QUESTION_TEXT    : Review the effective User Rights setting in Local Group Policy Editor.

Run "gpedit.msc".

Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment.

Review each User Right listed for any unresolved SIDs to determine whether they are valid, such as due to being temporarily disconnected from the domain. (Unresolved SIDs have the format of "*S-1-…".)

If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding.

For server core installations, run the following command:

Secedit /export /areas USER_RIGHTS /cfg c:\path\UserRights.txt

The results in the file identify user right assignments by SID instead of group name. Review the SIDs for unidentified ones. A list of typical SIDs \ Groups is below, search Microsoft for articles on well-known SIDs for others. 

If any unresolved SIDs exist and are not for currently valid accounts or groups, this is a finding.


SID - Group
S-1-5-11 - Authenticated Users
S-1-5-113 - Local account
S-1-5-114 - Local account and member of Administrators group
S-1-5-19 - Local Service
S-1-5-20 - Network Service
S-1-5-32-544 - Administrators
S-1-5-32-546 - Guests
S-1-5-6 - Service
S-1-5-9 - Enterprise Domain Controllers
S-1-5-domain-512 - Domain Admins
S-1-5-root domain-519 - Enterprise Admins
S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420 - NT Service\WdiServiceHost

References:
SV-92833
V-78127
CCI-000366

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 37 *******************************

QUESTION         : 38 of 56
TITLE            : CAT II, V-224875, SV-224875r958754, SRG-OS-000342-GPOS-00133
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:1121
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:1121
RULE             : Audit records must be backed up to a different system or media than the system being audited.
QUESTION_TEXT    : Determine if a process to back up log data to a different system or media than the system being audited has been implemented.

If it has not, this is a finding.

References:
SV-88053
V-73401
CCI-001851

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 38 *******************************

QUESTION         : 39 of 56
TITLE            : CAT II, V-224876, SV-224876r959008, SRG-OS-000479-GPOS-00224
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:1141
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:1141
RULE             : Windows Server 2016 must, at a minimum, offload audit records of interconnected systems in real time and offload standalone or nondomain-joined systems weekly.
QUESTION_TEXT    : Verify the audit records, at a minimum, are offloaded for interconnected systems in real time and offloaded for standalone or nondomain-joined systems weekly. 

If they are not, this is a finding.

References:
SV-88055
V-73403
CCI-001851

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 39 *******************************

QUESTION         : 40 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT II, V-224975, SV-224975r958524, SRG-OS-000138-GPOS-00069
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3081
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3081
RULE             : Data files owned by users must be on a different logical partition from the directory server data files.
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Run "Regedit".

Navigate to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters".

Note the directory locations in the values for "DSA Database file".

Open "Command Prompt".

Enter "net share".

Note the logical drive(s) or file system partition for any organization-created data shares.

Ignore system shares (e.g., NETLOGON, SYSVOL, and administrative shares ending in $). User shares that are hidden (ending with $) should not be ignored.

If user shares are located on the same logical partition as the directory server data files, this is a finding.

References:
V-73379
SV-88031
CCI-001090

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 40 *******************************

QUESTION         : 41 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT II, V-224976, SV-224976r958478, SRG-OS-000095-GPOS-00049
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3101
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3101
RULE             : Domain controllers must run on a machine dedicated to that function.
QUESTION_TEXT    : This applies to domain controllers, It is NA for other systems.

Review the installed roles the domain controller is supporting.

Start "Server Manager".

Select "AD DS" in the left pane and the server name under "Servers" to the right.

Select "Add (or Remove) Roles and Features" from "Tasks" in the "Roles and Features" section. (Cancel before any changes are made.)

Determine if any additional server roles are installed. A basic domain controller setup will include the following:

- Active Directory Domain Services
- DNS Server
- File and Storage Services

If any roles not requiring installation on a domain controller are installed, this is a finding. 

A Domain Name System (DNS) server integrated with the directory server (e.g., AD-integrated DNS) is an acceptable application. However, the DNS server must comply with the DNS STIG security requirements.

Run "Programs and Features".

Review installed applications.

If any applications are installed that are not required for the domain controller, this is a finding.

References:
SV-88033
V-73381
CCI-000381

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 41 *******************************

QUESTION         : 42 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT II, V-224977, SV-224977r987791, SRG-OS-000396-GPOS-00176
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3121
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3121
RULE             : Separate, NSA-approved (Type 1) cryptography must be used to protect the directory data in transit for directory service implementations at a classified confidentiality level when replication data traverses a network cleared to a lower level than the data.
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Review the organization network diagram(s) or documentation to determine the level of classification for the network(s) over which replication data is transmitted.

Determine the classification level of the Windows domain controller.

If the classification level of the Windows domain controller is higher than the level of the networks, review the organization network diagram(s) and directory implementation documentation to determine if NSA-approved encryption is used to protect the replication network traffic.

If the classification level of the Windows domain controller is higher than the level of the network traversed and NSA-approved encryption is not used, this is a finding.

References:
SV-88035
V-73383
CCI-002450

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 42 *******************************

QUESTION         : 43 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT II, V-224980, SV-224980r958732, SRG-OS-000327-GPOS-00127
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3181
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3181
RULE             : Active Directory Group Policy objects must be configured with proper audit settings.
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Review the auditing configuration for all Group Policy objects.

Open "Group Policy Management" (available from various menus or run "gpmc.msc").

Navigate to "Group Policy Objects" in the domain being reviewed (Forest >> Domains >> Domain).

For each Group Policy object:

Select the Group Policy object item in the left pane.

Select the "Delegation" tab in the right pane.

Select the "Advanced" button.

Select the "Advanced" button again and then the "Auditing" tab.

If the audit settings for any Group Policy object are not at least as inclusive as those below, this is a finding.

Type - Fail
Principal - Everyone
Access - Full Control
Applies to - This object and all descendant objects or Descendant groupPolicyContainer objects

The three Success types listed below are defaults inherited from the Parent Object. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference.

Type - Success
Principal - Everyone
Access - Special (Permissions: Write all properties, Modify permissions; Properties: all "Write" type selected)
Inherited from - Parent Object
Applies to - Descendant groupPolicyContainer objects

Two instances with the following summary information will be listed.

Type - Success
Principal - Everyone
Access - blank (Permissions: none selected; Properties: one instance - Write gPLink, one instance - Write gPOptions)
Inherited from - Parent Object
Applies to - Descendant Organization Unit Objects

References:
SV-88041
V-73389
CCI-000172
CCI-002234

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 43 *******************************

QUESTION         : 44 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT II, V-224981, SV-224981r958732, SRG-OS-000327-GPOS-00127
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3201
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3201
RULE             : The Active Directory Domain object must be configured with proper audit settings.
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Review the auditing configuration for the Domain object.

Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc").

Ensure "Advanced Features" is selected in the "View" menu.

Select the domain being reviewed in the left pane.

Right-click the domain name and select "Properties".

Select the "Security" tab.

Select the "Advanced" button and then the "Auditing" tab.

If the audit settings on the Domain object are not at least as inclusive as those below, this is a finding.

Type - Fail
Principal - Everyone
Access - Full Control
Inherited from - None
Applies to - This object only

The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default.

Two instances with the following summary information will be listed.

Type - Success
Principal - Everyone
Access - (blank)
Inherited from - None
Applies to - Special

Type - Success
Principal - Domain Users
Access - All extended rights
Inherited from - None
Applies to - This object only

Type - Success
Principal - Administrators
Access - All extended rights
Inherited from - None
Applies to - This object only

Type - Success
Principal - Everyone
Access - Special
Inherited from - None
Applies to - This object only
(Access - Special = Permissions: Write all properties, Modify permissions, Modify owner)

References:
SV-88043
V-73391
CCI-000172
CCI-002234

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 44 *******************************

QUESTION         : 45 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT II, V-224982, SV-224982r958732, SRG-OS-000327-GPOS-00127
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3221
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3221
RULE             : The Active Directory Infrastructure object must be configured with proper audit settings.
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Review the auditing configuration for Infrastructure object.

Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc").

Ensure "Advanced Features" is selected in the "View" menu.

Select the domain being reviewed in the left pane.

Right-click the "Infrastructure" object in the right pane and select "Properties".

Select the "Security" tab.

Select the "Advanced" button and then the "Auditing" tab.

If the audit settings on the Infrastructure object are not at least as inclusive as those below, this is a finding.

Type - Fail
Principal - Everyone
Access - Full Control
Inherited from - None

The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default.

Type - Success
Principal - Everyone
Access - Special
Inherited from - None
(Access - Special = Permissions: Write all properties, All extended rights, Change infrastructure master)

Two instances with the following summary information will be listed.
Type - Success
Principal - Everyone
Access - (blank)
Inherited from - (CN of domain)

References:
SV-88045
V-73393
CCI-000172
CCI-002234

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 45 *******************************

QUESTION         : 46 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT II, V-224983, SV-224983r958732, SRG-OS-000327-GPOS-00127
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3241
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3241
RULE             : The Active Directory Domain Controllers Organizational Unit (OU) object must be configured with proper audit settings.
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Review the auditing configuration for the Domain Controller OU object.

Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc").

Ensure "Advanced Features" is selected in the "View" menu.

Select the "Domain Controllers OU" under the domain being reviewed in the left pane.

Right-click the "Domain Controllers OU" object and select "Properties".

Select the "Security" tab.

Select the "Advanced" button and then the "Auditing" tab.

If the audit settings on the Domain Controllers OU object are not at least as inclusive as those below, this is a finding.

Type - Fail
Principal - Everyone
Access - Full Control
Inherited from - None
Applies to - This object and all descendant objects

The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default.

Type - Success
Principal - Everyone
Access - Special
Inherited from - None
Applies to - This object only
(Access - Special = Permissions: all create, delete and modify permissions)

Type - Success
Principal - Everyone
Access - Write all properties
Inherited from - None
Applies to - This object and all descendant objects

Two instances with the following summary information will be listed.

Type - Success
Principal - Everyone
Access - (blank)
Inherited from - (CN of domain)
Applies to - Descendant Organizational Unit objects

References:
SV-88047
V-73395
CCI-000172
CCI-002234

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 46 *******************************

QUESTION         : 47 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT II, V-224984, SV-224984r958732, SRG-OS-000327-GPOS-00127
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3261
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3261
RULE             : The Active Directory AdminSDHolder object must be configured with proper audit settings.
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Review the auditing configuration for the "AdminSDHolder" object.

Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc").

Ensure "Advanced Features" is selected in the "View" menu.

Select "System" under the domain being reviewed in the left pane.

Right-click the "AdminSDHolder" object in the right pane and select "Properties".

Select the "Security" tab.

Select the "Advanced" button and then the "Auditing" tab.

If the audit settings on the "AdminSDHolder" object are not at least as inclusive as those below, this is a finding.

Type - Fail
Principal - Everyone
Access - Full Control
Inherited from - None
Applies to - This object only

The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default.

Type - Success
Principal - Everyone
Access - Special
Inherited from - None
Applies to - This object only
(Access - Special = Write all properties, Modify permissions, Modify owner)

Two instances with the following summary information will be listed.

Type - Success
Principal - Everyone
Access - (blank)
Inherited from - (CN of domain)
Applies to - Descendant Organizational Unit objects

References:
SV-88049
V-73397
CCI-000172
CCI-002234

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 47 *******************************

QUESTION         : 48 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT II, V-224985, SV-224985r958732, SRG-OS-000327-GPOS-00127
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3281
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3281
RULE             : The Active Directory RID Manager$ object must be configured with proper audit settings.
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Review the auditing configuration for the "RID Manager$" object.

Open "Active Directory Users and Computers" (available from various menus or run "dsa.msc").

Ensure "Advanced Features" is selected in the "View" menu.

Select "System" under the domain being reviewed in the left pane.

Right-click the "RID Manager$" object in the right pane and select "Properties".

Select the "Security" tab.

Select the "Advanced" button and then the "Auditing" tab.

If the audit settings on the "RID Manager$" object are not at least as inclusive as those below, this is a finding.

Type - Fail
Principal - Everyone
Access - Full Control
Inherited from - None

The success types listed below are defaults. Where Special is listed in the summary screens for Access, detailed Permissions are provided for reference. Various Properties selections may also exist by default.

Type - Success
Principal - Everyone
Access - Special
Inherited from - None
 (Access - Special = Write all properties, All extended rights, Change RID master)

Two instances with the following summary information will be listed.

Type - Success
Principal - Everyone
Access - (blank)
Inherited from - (CN of domain)

References:
SV-88051
V-73399
CCI-000172
CCI-002234

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 48 *******************************

QUESTION         : 49 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT II, V-224986, SV-224986r958368, SRG-OS-000004-GPOS-00004
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3301
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3301
RULE             : Windows Server 2016 must be configured to audit Account Management - Computer Account Management successes.
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN16-SO-000050) for the detailed auditing subcategories to be effective. 

Use the AuditPol tool to review the current Audit Policy configuration:

Open an elevated "Command Prompt" (run as administrator).

Enter "AuditPol /get /category:*".

Compare the AuditPol settings with the following.

If the system does not audit the following, this is a finding.

Account Management >> Computer Account Management - Success

References:
SV-88069
V-73417
CCI-000018
CCI-000172
CCI-001403
CCI-001404
CCI-001405
CCI-002130

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 49 *******************************

QUESTION         : 50 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT II, V-224991, SV-224991r958448, SRG-OS-000066-GPOS-00034
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3381
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3381
RULE             : Domain controllers must have a PKI server certificate.
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Run "MMC".

Select "Add/Remove Snap-in" from the "File" menu.

Select "Certificates" in the left pane and click the "Add >" button.

Select "Computer Account" and click "Next".

Select the appropriate option for "Select the computer you want this snap-in to manage" and click "Finish".

Click "OK".

Select and expand the Certificates (Local Computer) entry in the left pane.

Select and expand the Personal entry in the left pane.

Select the Certificates entry in the left pane.

If no certificate for the domain controller exists in the right pane, this is a finding.

References:
V-73611
SV-88275
CCI-000185

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 50 *******************************

QUESTION         : 51 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT II, V-224994, SV-224994r958484, SRG-OS-000105-GPOS-00052
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3441
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3441
RULE             : Active Directory user accounts, including administrators, must be configured to require the use of a Common Access Card (CAC), Personal Identity Verification (PIV)-compliant hardware token, or Alternate Logon Token (ALT) for user authentication.
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Open "PowerShell".

Enter the following:

"Get-ADUser -Filter {(Enabled -eq $True) -and (SmartcardLogonRequired -eq $False)} | FT Name"
("DistinguishedName" may be substituted for "Name" for more detailed output.)

If any user accounts, including administrators, are listed, this is a finding.

Alternately:

To view sample accounts in "Active Directory Users and Computers" (available from various menus or run "dsa.msc"):

Select the Organizational Unit (OU) where the user accounts are located. (By default, this is the Users node; however, accounts may be under other organization-defined OUs.)

Right-click the sample user account and select "Properties".

Select the "Account" tab.

If any user accounts, including administrators, do not have "Smart card is required for interactive logon" checked in the "Account Options" area, this is a finding.

References:
V-73617
SV-88281
CCI-000765
CCI-000766
CCI-000767
CCI-000768
CCI-001948

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 51 *******************************

QUESTION         : 52 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT II, V-225006, SV-225006r991589, SRG-OS-000480-GPOS-00227
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3681
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3681
RULE             : The password for the krbtgt account on a domain must be reset at least every 180 days.
QUESTION_TEXT    : This requirement is applicable to domain controllers; it is NA for other systems.

Open "Windows PowerShell".

Enter "Get-ADUser krbtgt -Property PasswordLastSet".

If the "PasswordLastSet" date is more than 180 days old, this is a finding.

References:
SV-101881
V-91779
CCI-000366

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 52 *******************************

QUESTION         : 53 of 56
TITLE            : CAT III, V-224836, SV-224836r958472, SRG-OS-000080-GPOS-00048
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:341
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:341
RULE             : Non-administrative accounts or groups must only have print permissions on printer shares.
QUESTION_TEXT    : Open "Devices and Printers".

If there are no printers configured, this is NA. (Exclude Microsoft Print to PDF and Microsoft XPS Document Writer, which do not support sharing.)

For each printer:

Right-click on the printer. 

Select "Printer Properties". 

Select the "Sharing" tab. 

If "Share this printer" is checked, select the "Security" tab.

If any standard user accounts or groups have permissions other than "Print", this is a finding.

The default is for the "Everyone" group to be given "Print" permission.

"All APPLICATION PACKAGES" and "CREATOR OWNER" are not standard user accounts.

References:
V-73257
SV-87909
CCI-000213

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 53 *******************************

QUESTION         : 54 of 56
TITLE            : CAT III, V-224862, SV-224862r982208, SRG-OS-000355-GPOS-00143
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:861
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:861
RULE             : The time service must synchronize with an appropriate DoD time source.
QUESTION_TEXT    : Review the Windows time service configuration.

Open an elevated "Command Prompt" (run as administrator).

Enter "W32tm /query /configuration".

Domain-joined systems (excluding the domain controller with the PDC emulator role):

If the value for "Type" under "NTP Client" is not "NT5DS", this is a finding.

Other systems:

If systems are configured with a "Type" of "NTP", including standalone or nondomain-joined systems and the domain controller with the PDC Emulator role, and do not have a DoD time server defined for "NTPServer", this is a finding.

To determine the domain controller with the PDC Emulator role:

Open "PowerShell".

Enter "Get-ADDomain | FT PDCEmulator".

References:
SV-87959
V-73307
CCI-001891

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 54 *******************************

QUESTION         : 55 of 56
APPLICABILITY    : Windows_DomainController
TITLE            : CAT III, V-224979, SV-224979r970703, SRG-OS-000163-GPOS-00072
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:3161
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:3161
RULE             : The directory service must be configured to terminate LDAP-based network connections to the directory server after 5 minutes of inactivity.
QUESTION_TEXT    : This applies to domain controllers. It is NA for other systems.

Open an elevated "Command Prompt" (run as administrator).

Enter "ntdsutil".

At the "ntdsutil:" prompt, enter "LDAP policies".

At the "ldap policy:" prompt, enter "connections".

At the "server connections:" prompt, enter "connect to server [host-name]"
(where [host-name] is the computer name of the domain controller).

At the "server connections:" prompt, enter "q".

At the "ldap policy:" prompt, enter "show values". 

If the value for MaxConnIdleTime is greater than "300" (5 minutes) or is not specified, this is a finding.

Enter "q" at the "ldap policy:" and "ntdsutil:" prompts to exit.

Alternately, Dsquery can be used to display MaxConnIdleTime:

Open "Command Prompt (Admin)".
Enter the following command (on a single line).

dsquery * "cn=Default Query Policy,cn=Query-Policies,cn=Directory Service, cn=Windows NT,cn=Services,cn=Configuration,dc=[forest-name]" -attr LDAPAdminLimits 

The quotes are required and dc=[forest-name] is the fully qualified LDAP name of the domain being reviewed (e.g., dc=disaost,dc=mil).

If the results do not specify a "MaxConnIdleTime" or it has a value greater than "300" (5 minutes), this is a finding.

References:
SV-88039
V-73387
CCI-001133

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 55 *******************************

QUESTION         : 56 of 56
TITLE            : CAT III, V-225037, SV-225037r958390, SRG-OS-000023-GPOS-00006
TEST_ACTION_ID   : ocil:navy.navwar.niwcatlantic.scc.windows:testaction:4301
QUESTION_ID      : ocil:navy.navwar.niwcatlantic.scc.windows:question:4301
RULE             : The Windows dialog box title for the legal banner must be configured with the appropriate text.
QUESTION_TEXT    : If the following registry value does not exist or is not configured as specified, this is a finding.

Registry Hive: HKEY_LOCAL_MACHINE 
Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

Value Name: LegalNoticeCaption

Value Type: REG_SZ
Value: See message title options below

"DoD Notice and Consent Banner", "US Department of Defense Warning Statement", or an organization-defined equivalent. 

If an organization-defined title is used, it can in no case contravene or modify the language of the banner text required in WN16-SO-000150.

Automated tools may only search for the titles defined above. If an organization-defined title is used, a manual review will be required.

References:
SV-88313
V-73649
CCI-000048
CCI-001384
CCI-001385
CCI-001386
CCI-001387
CCI-001388

     ===========================================================================
     Select One of the following by entering an X in the brackets
     [ ] Finding
     [ ] Not a Finding
     [ ] Not Applicable
     [X] Not Reviewed
     Enter any comments : 

******************************* end of question 56 *******************************

